Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/11/2024, 01:29
241112-bwgrxs1gnf 1008/07/2021, 12:18
210708-8z6d5h8z2n 1006/07/2021, 17:53
210706-g6we6sa7sa 1019/06/2021, 18:17
210619-vr8bj2dzfn 1017/06/2021, 21:39
210617-a9cvlnmrbx 1011/06/2021, 17:26
210611-wvab1yw2tj 1008/06/2021, 06:47
210608-qrbpch3y46 1008/06/2021, 06:47
210608-64tndgm1ln 1005/06/2021, 18:40
210605-cd6qpr55sx 1004/06/2021, 11:56
210604-5c416rs3ns 10Analysis
-
max time kernel
62s -
max time network
172s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04/06/2021, 11:56
Static task
static1
Behavioral task
behavioral1
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Install.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Install2.exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Install2.exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
keygen-step-4.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
keygen-step-4.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
keygen-step-4d.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
keygen-step-4d.exe
Resource
win10v20210408
Errors
General
-
Target
Install2.exe
-
Size
497KB
-
MD5
41a5f4fd1ea7cac4aa94a87aebccfef0
-
SHA1
0d0abf079413a4c773754bf4fda338dc5b9a8ddc
-
SHA256
97e95e99fd499ec45a7c1d8683d5731ce5e7a8fb8b710622e578cd169a00d8d9
-
SHA512
5ca14bda498f26efff4e1179969b8f2c25244063c7bf25f3ec20b5cd24b5be320bbfb8b3d0b2d66f5c5b415da777a766fece5f251a4247773c6cb991417fb75f
Malware Config
Signatures
-
ElysiumStealer
ElysiumStealer (previously known as ZeromaxStealer) is an info stealer that can steal login credentials for various accounts.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Downloads MZ/PE file
-
Drops file in Drivers directory 3 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Ultra.exe File opened for modification C:\Windows\system32\drivers\etc\hosts ___________23.exe File opened for modification C:\Windows\system32\drivers\etc\hosts installer.exe -
Executes dropped EXE 49 IoCs
pid Process 692 Install2.tmp 580 Ultra.exe 3744 ultramediaburner.exe 2068 ultramediaburner.tmp 2064 Vozhaelujeci.exe 3848 UltraMediaBurner.exe 3956 Belonekejy.exe 4836 001.exe 6072 installer.exe 4668 gaoou.exe 4812 jfiag3g_gg.exe 5172 Setup3310.exe 5652 Setup3310.tmp 6088 jfiag3g_gg.exe 4204 jfiag3g_gg.exe 5040 Setup.exe 4816 hjjgaa.exe 4956 RunWW.exe 188 guihuali-game.exe 3084 lylal220.exe 4976 003.exe 2428 BarSetpFile.exe 4192 LabPicV3.exe 5716 lylal220.tmp 4280 ask.exe 6008 Browser.exe 5160 LabPicV3.tmp 6088 jfiag3g_gg.exe 3788 cmd.exe 5576 Browzar.exe 5024 7788034.exe 1484 Conhost.exe 748 installer.exe 5288 ___________23.exe 6180 7762244.exe 6468 jfiag3g_gg.exe 6700 WinHoster.exe 5180 prolab.exe 6112 prolab.tmp 6376 irecord.exe 6192 Ryxululota.exe 6092 irecord.tmp 2468 Cixavumepae.exe 6228 ZHuqomimodu.exe 6488 Bywewequxa.exe 6328 i-record.exe 6252 yRVGeBTYzVxq.exe 6788 001.exe 7136 001.exe -
resource yara_rule behavioral4/files/0x000100000001abbf-173.dat upx behavioral4/files/0x000100000001abbf-172.dat upx behavioral4/files/0x000200000001ac27-222.dat upx behavioral4/files/0x000200000001ac27-223.dat upx -
resource yara_rule behavioral4/files/0x000100000001ac42-300.dat vmprotect behavioral4/files/0x000100000001ac42-298.dat vmprotect behavioral4/memory/4816-325-0x0000000000CF0000-0x000000000134F000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation Vozhaelujeci.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation jfiag3g_gg.exe Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation guihuali-game.exe -
Loads dropped DLL 46 IoCs
pid Process 692 Install2.tmp 6072 installer.exe 6072 installer.exe 5652 Setup3310.tmp 5652 Setup3310.tmp 6072 installer.exe 5544 MsiExec.exe 5544 MsiExec.exe 2468 Cixavumepae.exe 5716 lylal220.tmp 5160 LabPicV3.tmp 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 6168 rUNdlL32.eXe 4248 MsiExec.exe 4248 MsiExec.exe 4248 MsiExec.exe 6072 Process not Found 4248 MsiExec.exe 4248 MsiExec.exe 4956 RunWW.exe 4956 RunWW.exe 7100 005.exe 7100 005.exe 7100 005.exe 7100 005.exe 7100 005.exe 7100 005.exe 6328 i-record.exe 6328 i-record.exe 7100 005.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 6328 i-record.exe 4248 taskkill.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1408 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Windows Mail\\Puculenafe.exe\"" Ultra.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" gaoou.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" Conhost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Google\\Gonicusugi.exe\"" ___________23.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Nizhudirejo.exe\"" installer.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Browzar.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 10 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 503 api.2ip.ua 43 ip-api.com 71 ipinfo.io 302 ip-api.com 314 ipinfo.io 471 api.2ip.ua 77 ipinfo.io 319 ipinfo.io 324 ipinfo.io 472 api.2ip.ua -
Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 884 set thread context of 5404 884 svchost.exe 119 PID 3788 set thread context of 6252 3788 cmd.exe 168 -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\recording\avformat-53.dll irecord.tmp File created C:\Program Files (x86)\recording\is-573KQ.tmp irecord.tmp File created C:\Program Files (x86)\recording\is-EBRJP.tmp irecord.tmp File opened for modification C:\Program Files (x86)\recording\unins000.dat irecord.tmp File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe Setup.exe File created C:\Program Files\Microsoft Office\NABQAERDPS\prolab.exe ___________23.exe File created C:\Program Files\Microsoft Office\ZIPHTYXPKS\irecord.exe.config installer.exe File created C:\Program Files (x86)\Picture Lab\is-S7CCA.tmp prolab.tmp File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe Setup.exe File opened for modification C:\Program Files (x86)\Picture Lab\unins000.dat prolab.tmp File opened for modification C:\Program Files (x86)\recording\AForge.Video.dll irecord.tmp File created C:\Program Files (x86)\recording\is-VIJ0S.tmp irecord.tmp File created C:\Program Files (x86)\Picture Lab\is-BBNCE.tmp prolab.tmp File created C:\Program Files (x86)\recording\is-QP5R4.tmp irecord.tmp File created C:\Program Files (x86)\recording\is-C47T9.tmp irecord.tmp File created C:\Program Files (x86)\Windows Mail\Puculenafe.exe.config Ultra.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe Setup.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe Setup.exe File opened for modification C:\Program Files (x86)\Picture Lab\DockingToolbar.dll prolab.tmp File created C:\Program Files (x86)\recording\is-L9SG1.tmp irecord.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\Browser.exe Setup.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Math.dll prolab.tmp File opened for modification C:\Program Files (x86)\recording\i-record.exe irecord.tmp File created C:\Program Files (x86)\Reference Assemblies\Nizhudirejo.exe installer.exe File opened for modification C:\Program Files (x86)\recording\Bunifu_UI_v1.52.dll irecord.tmp File opened for modification C:\Program Files (x86)\recording\avfilter-2.dll irecord.tmp File created C:\Program Files (x86)\recording\is-0PR1K.tmp irecord.tmp File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\ask.exe Setup.exe File opened for modification C:\Program Files (x86)\Data Finder\Versium Research\Uninstall.exe Setup.exe File opened for modification C:\Program Files (x86)\Picture Lab\AForge.Imaging.dll prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\SourceGrid2.dll prolab.tmp File opened for modification C:\Program Files (x86)\Picture Lab\AForge.dll prolab.tmp File opened for modification C:\Program Files (x86)\recording\AForge.Video.FFMPEG.dll irecord.tmp File created C:\Program Files (x86)\recording\is-KIDML.tmp irecord.tmp File created C:\Program Files (x86)\Browzar\Uninstall.ini Browser.exe File created C:\Program Files (x86)\Picture Lab\is-8O100.tmp prolab.tmp File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File created C:\Program Files (x86)\recording\is-V8L5P.tmp irecord.tmp File created C:\Program Files (x86)\recording\is-370I8.tmp irecord.tmp File created C:\Program Files (x86)\UltraMediaBurner\is-S1LHN.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\Browzar\Browzar.exe Browser.exe File created C:\Program Files (x86)\Picture Lab\is-KHOCG.tmp prolab.tmp File opened for modification C:\Program Files (x86)\recording\swresample-0.dll irecord.tmp File created C:\Program Files\Common Files\IVECXXNULD\ultramediaburner.exe.config Ultra.exe File created C:\Program Files (x86)\Picture Lab\is-0KON2.tmp prolab.tmp File created C:\Program Files (x86)\Google\Gonicusugi.exe.config ___________23.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File created C:\Program Files (x86)\Reference Assemblies\Nizhudirejo.exe.config installer.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File opened for modification C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe Browser.exe File opened for modification C:\Program Files (x86)\Picture Lab\WeifenLuo.WinFormsUI.dll prolab.tmp File opened for modification C:\Program Files (x86)\recording\unins000.exe irecord.tmp File created C:\Program Files (x86)\recording\unins000.dat irecord.tmp File created C:\Program Files (x86)\recording\is-I28R2.tmp irecord.tmp File created C:\Program Files (x86)\Google\Gonicusugi.exe ___________23.exe File created C:\Program Files (x86)\Picture Lab\unins000.dat prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-ASGQI.tmp prolab.tmp File created C:\Program Files (x86)\Picture Lab\is-4HS38.tmp prolab.tmp File opened for modification C:\Program Files (x86)\recording\avdevice-53.dll irecord.tmp File created C:\Program Files (x86)\recording\is-GH5K3.tmp irecord.tmp File created C:\Program Files (x86)\recording\is-08IST.tmp irecord.tmp File created C:\Program Files (x86)\Picture Lab\is-NR289.tmp prolab.tmp -
Drops file in Windows directory 33 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIFEF8.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIFFC4.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1B35.tmp msiexec.exe File created C:\Windows\Installer\f74d347.msi msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI71.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1835.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI19AD.tmp msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\f74d344.msi msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI2878.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2DAC.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\Installer\f74d344.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI2A6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1BB3.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2AFB.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI2973.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI4379.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI17C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI1620.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI2598.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI27CC.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIDD46.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3C0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI172B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI3AEB.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 7016 5576 WerFault.exe 139 4376 5024 WerFault.exe 140 4636 7088 WerFault.exe 259 7204 4612 WerFault.exe 282 -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RunWW.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RunWW.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 7144 timeout.exe 4200 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 4420 taskkill.exe 6628 taskkill.exe 6776 taskkill.exe 4248 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\16\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\InstanceType = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance jfiag3g_gg.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\PackageName = "Windows Manager - Postback Y.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows\AllowInPrivate MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowser MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "2e48w27" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 5bb487164959d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP} Cixavumepae.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "5456" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Version = "16777216" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AdvertiseFlags = "388" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C414548CC3098124D97E31A29BF7FD26\MainFeature msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26 msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\DiskPrompt = "[1]" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Vozhaelujeci.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Vozhaelujeci.exe -
Script User-Agent 11 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 239 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 316 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 318 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 328 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 329 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 77 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 81 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 136 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 159 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 72 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 126 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2068 ultramediaburner.tmp 2068 ultramediaburner.tmp 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe 3956 Belonekejy.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 6100 MicrosoftEdgeCP.exe 6100 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 580 Ultra.exe Token: SeDebugPrivilege 2064 Vozhaelujeci.exe Token: SeDebugPrivilege 3956 Belonekejy.exe Token: SeDebugPrivilege 4148 MicrosoftEdge.exe Token: SeDebugPrivilege 4148 MicrosoftEdge.exe Token: SeDebugPrivilege 4148 MicrosoftEdge.exe Token: SeDebugPrivilege 4148 MicrosoftEdge.exe Token: SeDebugPrivilege 4596 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4596 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4596 MicrosoftEdgeCP.exe Token: SeDebugPrivilege 4596 MicrosoftEdgeCP.exe Token: SeSecurityPrivilege 5108 msiexec.exe Token: SeCreateTokenPrivilege 6072 installer.exe Token: SeAssignPrimaryTokenPrivilege 6072 installer.exe Token: SeLockMemoryPrivilege 6072 installer.exe Token: SeIncreaseQuotaPrivilege 6072 installer.exe Token: SeMachineAccountPrivilege 6072 installer.exe Token: SeTcbPrivilege 6072 installer.exe Token: SeSecurityPrivilege 6072 installer.exe Token: SeTakeOwnershipPrivilege 6072 installer.exe Token: SeLoadDriverPrivilege 6072 installer.exe Token: SeSystemProfilePrivilege 6072 installer.exe Token: SeSystemtimePrivilege 6072 installer.exe Token: SeProfSingleProcessPrivilege 6072 installer.exe Token: SeIncBasePriorityPrivilege 6072 installer.exe Token: SeCreatePagefilePrivilege 6072 installer.exe Token: SeCreatePermanentPrivilege 6072 installer.exe Token: SeBackupPrivilege 6072 installer.exe Token: SeRestorePrivilege 6072 installer.exe Token: SeShutdownPrivilege 6072 installer.exe Token: SeDebugPrivilege 6072 installer.exe Token: SeAuditPrivilege 6072 installer.exe Token: SeSystemEnvironmentPrivilege 6072 installer.exe Token: SeChangeNotifyPrivilege 6072 installer.exe Token: SeRemoteShutdownPrivilege 6072 installer.exe Token: SeUndockPrivilege 6072 installer.exe Token: SeSyncAgentPrivilege 6072 installer.exe Token: SeEnableDelegationPrivilege 6072 installer.exe Token: SeManageVolumePrivilege 6072 installer.exe Token: SeImpersonatePrivilege 6072 installer.exe Token: SeCreateGlobalPrivilege 6072 installer.exe Token: SeCreateTokenPrivilege 6072 installer.exe Token: SeAssignPrimaryTokenPrivilege 6072 installer.exe Token: SeLockMemoryPrivilege 6072 installer.exe Token: SeIncreaseQuotaPrivilege 6072 installer.exe Token: SeMachineAccountPrivilege 6072 installer.exe Token: SeTcbPrivilege 6072 installer.exe Token: SeSecurityPrivilege 6072 installer.exe Token: SeTakeOwnershipPrivilege 6072 installer.exe Token: SeLoadDriverPrivilege 6072 installer.exe Token: SeSystemProfilePrivilege 6072 installer.exe Token: SeSystemtimePrivilege 6072 installer.exe Token: SeProfSingleProcessPrivilege 6072 installer.exe Token: SeIncBasePriorityPrivilege 6072 installer.exe Token: SeCreatePagefilePrivilege 6072 installer.exe Token: SeCreatePermanentPrivilege 6072 installer.exe Token: SeBackupPrivilege 6072 installer.exe Token: SeRestorePrivilege 6072 installer.exe Token: SeShutdownPrivilege 6072 installer.exe Token: SeDebugPrivilege 6072 installer.exe Token: SeAuditPrivilege 6072 installer.exe Token: SeSystemEnvironmentPrivilege 6072 installer.exe Token: SeChangeNotifyPrivilege 6072 installer.exe Token: SeRemoteShutdownPrivilege 6072 installer.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 2068 ultramediaburner.tmp 6072 installer.exe 5652 Setup3310.tmp 6112 prolab.tmp 6092 irecord.tmp -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 4148 MicrosoftEdge.exe 6100 MicrosoftEdgeCP.exe 6100 MicrosoftEdgeCP.exe 5576 Browzar.exe 5576 Browzar.exe 5576 Browzar.exe 5576 Browzar.exe 5576 Browzar.exe 5576 Browzar.exe 5576 Browzar.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 740 wrote to memory of 692 740 Install2.exe 74 PID 740 wrote to memory of 692 740 Install2.exe 74 PID 740 wrote to memory of 692 740 Install2.exe 74 PID 692 wrote to memory of 580 692 Install2.tmp 76 PID 692 wrote to memory of 580 692 Install2.tmp 76 PID 580 wrote to memory of 3744 580 Ultra.exe 79 PID 580 wrote to memory of 3744 580 Ultra.exe 79 PID 580 wrote to memory of 3744 580 Ultra.exe 79 PID 3744 wrote to memory of 2068 3744 ultramediaburner.exe 80 PID 3744 wrote to memory of 2068 3744 ultramediaburner.exe 80 PID 3744 wrote to memory of 2068 3744 ultramediaburner.exe 80 PID 580 wrote to memory of 2064 580 Ultra.exe 81 PID 580 wrote to memory of 2064 580 Ultra.exe 81 PID 2068 wrote to memory of 3848 2068 ultramediaburner.tmp 82 PID 2068 wrote to memory of 3848 2068 ultramediaburner.tmp 82 PID 580 wrote to memory of 3956 580 Ultra.exe 83 PID 580 wrote to memory of 3956 580 Ultra.exe 83 PID 3956 wrote to memory of 4360 3956 Belonekejy.exe 88 PID 3956 wrote to memory of 4360 3956 Belonekejy.exe 88 PID 4360 wrote to memory of 4836 4360 cmd.exe 90 PID 4360 wrote to memory of 4836 4360 cmd.exe 90 PID 4360 wrote to memory of 4836 4360 cmd.exe 90 PID 3956 wrote to memory of 5572 3956 Belonekejy.exe 92 PID 3956 wrote to memory of 5572 3956 Belonekejy.exe 92 PID 3956 wrote to memory of 5900 3956 Belonekejy.exe 94 PID 3956 wrote to memory of 5900 3956 Belonekejy.exe 94 PID 5900 wrote to memory of 6072 5900 cmd.exe 96 PID 5900 wrote to memory of 6072 5900 cmd.exe 96 PID 5900 wrote to memory of 6072 5900 cmd.exe 96 PID 3956 wrote to memory of 4536 3956 Belonekejy.exe 98 PID 3956 wrote to memory of 4536 3956 Belonekejy.exe 98 PID 4536 wrote to memory of 4668 4536 cmd.exe 101 PID 4536 wrote to memory of 4668 4536 cmd.exe 101 PID 4536 wrote to memory of 4668 4536 cmd.exe 101 PID 4668 wrote to memory of 4812 4668 gaoou.exe 102 PID 4668 wrote to memory of 4812 4668 gaoou.exe 102 PID 4668 wrote to memory of 4812 4668 gaoou.exe 102 PID 3956 wrote to memory of 4908 3956 Belonekejy.exe 104 PID 3956 wrote to memory of 4908 3956 Belonekejy.exe 104 PID 4908 wrote to memory of 5172 4908 cmd.exe 106 PID 4908 wrote to memory of 5172 4908 cmd.exe 106 PID 4908 wrote to memory of 5172 4908 cmd.exe 106 PID 5172 wrote to memory of 5652 5172 Setup3310.exe 107 PID 5172 wrote to memory of 5652 5172 Setup3310.exe 107 PID 5172 wrote to memory of 5652 5172 Setup3310.exe 107 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 5108 wrote to memory of 5544 5108 msiexec.exe 109 PID 5108 wrote to memory of 5544 5108 msiexec.exe 109 PID 5108 wrote to memory of 5544 5108 msiexec.exe 109 PID 3956 wrote to memory of 6008 3956 Belonekejy.exe 129 PID 3956 wrote to memory of 6008 3956 Belonekejy.exe 129 PID 6008 wrote to memory of 6088 6008 Browser.exe 134 PID 6008 wrote to memory of 6088 6008 Browser.exe 134 PID 6008 wrote to memory of 6088 6008 Browser.exe 134 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 6100 wrote to memory of 4596 6100 MicrosoftEdgeCP.exe 100 PID 4668 wrote to memory of 4204 4668 gaoou.exe 113 PID 4668 wrote to memory of 4204 4668 gaoou.exe 113 PID 4668 wrote to memory of 4204 4668 gaoou.exe 113 PID 6072 wrote to memory of 4228 6072 installer.exe 114
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2804
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2788
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2712
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2588
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2536
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1872
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1396
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1264
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1196
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1076
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:408
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\Install2.exe"C:\Users\Admin\AppData\Local\Temp\Install2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Users\Admin\AppData\Local\Temp\is-CP6HT.tmp\Install2.tmp"C:\Users\Admin\AppData\Local\Temp\is-CP6HT.tmp\Install2.tmp" /SL5="$20120,235791,152064,C:\Users\Admin\AppData\Local\Temp\Install2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:692 -
C:\Users\Admin\AppData\Local\Temp\is-QM0DI.tmp\Ultra.exe"C:\Users\Admin\AppData\Local\Temp\is-QM0DI.tmp\Ultra.exe" /S /UID=burnerch13⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Program Files\Common Files\IVECXXNULD\ultramediaburner.exe"C:\Program Files\Common Files\IVECXXNULD\ultramediaburner.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Users\Admin\AppData\Local\Temp\is-83H2I.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-83H2I.tmp\ultramediaburner.tmp" /SL5="$80060,281924,62464,C:\Program Files\Common Files\IVECXXNULD\ultramediaburner.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
PID:3848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\fd-541b1-894-9a583-7b12ece6817fe\Vozhaelujeci.exe"C:\Users\Admin\AppData\Local\Temp\fd-541b1-894-9a583-7b12ece6817fe\Vozhaelujeci.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Users\Admin\AppData\Local\Temp\b9-73d26-520-006b7-64b5afb49e2c1\Belonekejy.exe"C:\Users\Admin\AppData\Local\Temp\b9-73d26-520-006b7-64b5afb49e2c1\Belonekejy.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xxpmhqkq.aeq\001.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4360 -
C:\Users\Admin\AppData\Local\Temp\xxpmhqkq.aeq\001.exeC:\Users\Admin\AppData\Local\Temp\xxpmhqkq.aeq\001.exe6⤵
- Executes dropped EXE
PID:4836
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\p0kerrk3.1ui\GcleanerEU.exe /eufive & exit5⤵PID:5572
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\j302120n.rg5\installer.exe /qn CAMPAIGN="654" & exit5⤵
- Suspicious use of WriteProcessMemory
PID:5900 -
C:\Users\Admin\AppData\Local\Temp\j302120n.rg5\installer.exeC:\Users\Admin\AppData\Local\Temp\j302120n.rg5\installer.exe /qn CAMPAIGN="654"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:6072 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\j302120n.rg5\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\j302120n.rg5\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1622555530 /qn CAMPAIGN=""654"" " CAMPAIGN="654"7⤵PID:4228
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\is1fycg3.m20\gaoou.exe & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Local\Temp\is1fycg3.m20\gaoou.exeC:\Users\Admin\AppData\Local\Temp\is1fycg3.m20\gaoou.exe6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4668 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4812
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4204
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\1kf0vtum.qet\Setup3310.exe /Verysilent /subid=623 & exit5⤵
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Users\Admin\AppData\Local\Temp\1kf0vtum.qet\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\1kf0vtum.qet\Setup3310.exe /Verysilent /subid=6236⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5172 -
C:\Users\Admin\AppData\Local\Temp\is-S5HHI.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-S5HHI.tmp\Setup3310.tmp" /SL5="$5034C,138429,56832,C:\Users\Admin\AppData\Local\Temp\1kf0vtum.qet\Setup3310.exe" /Verysilent /subid=6237⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:5652 -
C:\Users\Admin\AppData\Local\Temp\is-N2HOB.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-N2HOB.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5040 -
C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"C:\Program Files (x86)\Data Finder\Versium Research\hjjgaa.exe"9⤵
- Executes dropped EXE
PID:4816 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
- Checks computer location settings
- Modifies registry class
PID:6088
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵
- Executes dropped EXE
PID:6468
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4956 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im RunWW.exe /f & timeout /t 6 & del /f /q "C:\Program Files (x86)\Data Finder\Versium Research\RunWW.exe" & del C:\ProgramData\*.dll & exit10⤵PID:6712
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV111⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1484
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im RunWW.exe /f11⤵
- Kills process with taskkill
PID:6776
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 611⤵
- Delays execution with timeout.exe
PID:7144
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"C:\Program Files (x86)\Data Finder\Versium Research\guihuali-game.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
PID:188 -
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install10⤵
- Loads dropped DLL
PID:6168
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"9⤵
- Executes dropped EXE
PID:3084 -
C:\Users\Admin\AppData\Local\Temp\is-DEHFM.tmp\lylal220.tmp"C:\Users\Admin\AppData\Local\Temp\is-DEHFM.tmp\lylal220.tmp" /SL5="$40444,140518,56832,C:\Program Files (x86)\Data Finder\Versium Research\lylal220.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5716 -
C:\Users\Admin\AppData\Local\Temp\is-GI08O.tmp\___________RUb__________y.exe"C:\Users\Admin\AppData\Local\Temp\is-GI08O.tmp\___________RUb__________y.exe" /S /UID=lylal22011⤵PID:748
-
C:\Program Files\Microsoft Office\ZIPHTYXPKS\irecord.exe"C:\Program Files\Microsoft Office\ZIPHTYXPKS\irecord.exe" /VERYSILENT12⤵
- Executes dropped EXE
PID:6376 -
C:\Users\Admin\AppData\Local\Temp\is-K644Q.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-K644Q.tmp\irecord.tmp" /SL5="$30562,6139911,56832,C:\Program Files\Microsoft Office\ZIPHTYXPKS\irecord.exe" /VERYSILENT13⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6092 -
C:\Program Files (x86)\recording\i-record.exe"C:\Program Files (x86)\recording\i-record.exe" -silent -desktopShortcut -programMenu14⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6328
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\03-95fd0-174-ac7ae-7b825c716d840\ZHuqomimodu.exe"C:\Users\Admin\AppData\Local\Temp\03-95fd0-174-ac7ae-7b825c716d840\ZHuqomimodu.exe"12⤵
- Executes dropped EXE
PID:6228
-
-
C:\Users\Admin\AppData\Local\Temp\14-4b9b0-923-984b8-6eab8e6bbed7d\Bywewequxa.exe"C:\Users\Admin\AppData\Local\Temp\14-4b9b0-923-984b8-6eab8e6bbed7d\Bywewequxa.exe"12⤵
- Executes dropped EXE
PID:6488 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fnyaapid.hu3\001.exe & exit13⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\fnyaapid.hu3\001.exeC:\Users\Admin\AppData\Local\Temp\fnyaapid.hu3\001.exe14⤵
- Executes dropped EXE
PID:7136
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0xjurixg.gmu\GcleanerEU.exe /eufive & exit13⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3788
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\a0yieuy2.tlo\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:6796
-
C:\Users\Admin\AppData\Local\Temp\a0yieuy2.tlo\installer.exeC:\Users\Admin\AppData\Local\Temp\a0yieuy2.tlo\installer.exe /qn CAMPAIGN="654"14⤵PID:6536
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2wxuu2su.sb0\gaoou.exe & exit13⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\2wxuu2su.sb0\gaoou.exeC:\Users\Admin\AppData\Local\Temp\2wxuu2su.sb0\gaoou.exe14⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:6664
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:492
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\50bp2fjb.uhd\Setup3310.exe /Verysilent /subid=623 & exit13⤵PID:6812
-
C:\Users\Admin\AppData\Local\Temp\50bp2fjb.uhd\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\50bp2fjb.uhd\Setup3310.exe /Verysilent /subid=62314⤵PID:4840
-
C:\Users\Admin\AppData\Local\Temp\is-9M3SU.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-9M3SU.tmp\Setup3310.tmp" /SL5="$202D8,138429,56832,C:\Users\Admin\AppData\Local\Temp\50bp2fjb.uhd\Setup3310.exe" /Verysilent /subid=62315⤵PID:5188
-
C:\Users\Admin\AppData\Local\Temp\is-23OB2.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-23OB2.tmp\Setup.exe" /Verysilent16⤵PID:492
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pdqzdsok.dmz\google-game.exe & exit13⤵PID:6352
-
C:\Users\Admin\AppData\Local\Temp\pdqzdsok.dmz\google-game.exeC:\Users\Admin\AppData\Local\Temp\pdqzdsok.dmz\google-game.exe14⤵PID:5304
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get15⤵PID:7460
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\wagzu3yt.haw\GcleanerWW.exe /mixone & exit13⤵PID:5556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\xwefjdte.33u\005.exe & exit13⤵PID:4564
-
C:\Users\Admin\AppData\Local\Temp\xwefjdte.33u\005.exeC:\Users\Admin\AppData\Local\Temp\xwefjdte.33u\005.exe14⤵
- Loads dropped DLL
PID:7100
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ofxwvdfu.4oj\toolspab1.exe & exit13⤵PID:4296
-
C:\Users\Admin\AppData\Local\Temp\ofxwvdfu.4oj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ofxwvdfu.4oj\toolspab1.exe14⤵PID:3316
-
C:\Users\Admin\AppData\Local\Temp\ofxwvdfu.4oj\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ofxwvdfu.4oj\toolspab1.exe15⤵PID:7480
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\uz4dqrll.kyt\702564a0.exe & exit13⤵PID:7752
-
C:\Users\Admin\AppData\Local\Temp\uz4dqrll.kyt\702564a0.exeC:\Users\Admin\AppData\Local\Temp\uz4dqrll.kyt\702564a0.exe14⤵PID:7532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\vu0h5mp5.spi\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:8076
-
C:\Users\Admin\AppData\Local\Temp\vu0h5mp5.spi\installer.exeC:\Users\Admin\AppData\Local\Temp\vu0h5mp5.spi\installer.exe /qn CAMPAIGN="654"14⤵PID:1244
-
-
-
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\003.exe"C:\Program Files (x86)\Data Finder\Versium Research\003.exe"9⤵
- Executes dropped EXE
PID:4976
-
-
C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"C:\Program Files (x86)\Data Finder\Versium Research\BarSetpFile.exe"9⤵
- Executes dropped EXE
PID:2428 -
C:\Users\Admin\AppData\Roaming\7788034.exe"C:\Users\Admin\AppData\Roaming\7788034.exe"10⤵
- Executes dropped EXE
PID:5024 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5024 -s 193211⤵
- Program crash
PID:4376
-
-
-
C:\Users\Admin\AppData\Roaming\6339919.exe"C:\Users\Admin\AppData\Roaming\6339919.exe"10⤵PID:1484
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"11⤵
- Executes dropped EXE
PID:6700
-
-
-
C:\Users\Admin\AppData\Roaming\7762244.exe"C:\Users\Admin\AppData\Roaming\7762244.exe"10⤵
- Executes dropped EXE
PID:6180 -
C:\Users\Admin\AppData\Roaming\7762244.exe"{path}"11⤵PID:7956
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\Browser.exe"C:\Program Files (x86)\Data Finder\Versium Research\Browser.exe"9⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:6008 -
C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"10⤵PID:3788
-
C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"C:\Program Files (x86)\Browzar\yRVGeBTYzVxq.exe"11⤵
- Executes dropped EXE
PID:6252
-
-
-
C:\Program Files (x86)\Browzar\Browzar.exe"C:\Program Files (x86)\Browzar\Browzar.exe"10⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
PID:5576 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5576 -s 213611⤵
- Program crash
PID:7016
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\ask.exe"C:\Program Files (x86)\Data Finder\Versium Research\ask.exe"9⤵
- Executes dropped EXE
PID:4280 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe10⤵PID:6524
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe11⤵
- Kills process with taskkill
PID:6628
-
-
-
-
C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"9⤵
- Executes dropped EXE
PID:4192
-
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lls5dfdq.qgp\google-game.exe & exit5⤵PID:6008
-
C:\Users\Admin\AppData\Local\Temp\lls5dfdq.qgp\google-game.exeC:\Users\Admin\AppData\Local\Temp\lls5dfdq.qgp\google-game.exe6⤵PID:6088
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get7⤵PID:2468
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\w2ozog0l.b0b\GcleanerWW.exe /mixone & exit5⤵PID:4768
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kzig4emo.4dy\005.exe & exit5⤵PID:3792
-
C:\Users\Admin\AppData\Local\Temp\kzig4emo.4dy\005.exeC:\Users\Admin\AppData\Local\Temp\kzig4emo.4dy\005.exe6⤵PID:6980
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gtbzuwf2.w1d\toolspab1.exe & exit5⤵PID:6056
-
C:\Users\Admin\AppData\Local\Temp\gtbzuwf2.w1d\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\gtbzuwf2.w1d\toolspab1.exe6⤵PID:7248
-
C:\Users\Admin\AppData\Local\Temp\gtbzuwf2.w1d\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\gtbzuwf2.w1d\toolspab1.exe7⤵PID:8076
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cdehj4mc.bm5\702564a0.exe & exit5⤵PID:7412
-
C:\Users\Admin\AppData\Local\Temp\cdehj4mc.bm5\702564a0.exeC:\Users\Admin\AppData\Local\Temp\cdehj4mc.bm5\702564a0.exe6⤵PID:7900
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\y4jxxapa.3jv\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:7556
-
C:\Users\Admin\AppData\Local\Temp\y4jxxapa.3jv\installer.exeC:\Users\Admin\AppData\Local\Temp\y4jxxapa.3jv\installer.exe /qn CAMPAIGN="654"6⤵PID:7996
-
-
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
PID:884 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5404
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4148
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5064
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:6100
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4596
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding DDAA2D28D5D456C0AD6B9098AAC0A1F3 C2⤵
- Loads dropped DLL
PID:5544
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 83AE7A30F083AAACA66E830B10C27B8E2⤵
- Loads dropped DLL
PID:4248 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:4420
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 974A0B5B9D60A331003AF74FF4837547 E Global\MSI00002⤵PID:7100
-
-
C:\Users\Admin\AppData\Local\Temp\is-2L6D3.tmp\LabPicV3.tmp"C:\Users\Admin\AppData\Local\Temp\is-2L6D3.tmp\LabPicV3.tmp" /SL5="$10474,140559,56832,C:\Program Files (x86)\Data Finder\Versium Research\LabPicV3.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5160 -
C:\Users\Admin\AppData\Local\Temp\is-40T5N.tmp\___________23.exe"C:\Users\Admin\AppData\Local\Temp\is-40T5N.tmp\___________23.exe" /S /UID=lab2142⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:5288 -
C:\Program Files\Microsoft Office\NABQAERDPS\prolab.exe"C:\Program Files\Microsoft Office\NABQAERDPS\prolab.exe" /VERYSILENT3⤵
- Executes dropped EXE
PID:5180 -
C:\Users\Admin\AppData\Local\Temp\is-69A95.tmp\prolab.tmp"C:\Users\Admin\AppData\Local\Temp\is-69A95.tmp\prolab.tmp" /SL5="$402AA,575243,216576,C:\Program Files\Microsoft Office\NABQAERDPS\prolab.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6112
-
-
-
C:\Users\Admin\AppData\Local\Temp\5a-dacb1-849-9b7be-143500c3da24b\Ryxululota.exe"C:\Users\Admin\AppData\Local\Temp\5a-dacb1-849-9b7be-143500c3da24b\Ryxululota.exe"3⤵
- Executes dropped EXE
PID:6192
-
-
C:\Users\Admin\AppData\Local\Temp\46-748c4-306-93aad-69371897ad8e4\Cixavumepae.exe"C:\Users\Admin\AppData\Local\Temp\46-748c4-306-93aad-69371897ad8e4\Cixavumepae.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2468 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\chbxtxiw.vmm\001.exe & exit4⤵PID:6040
-
C:\Users\Admin\AppData\Local\Temp\chbxtxiw.vmm\001.exeC:\Users\Admin\AppData\Local\Temp\chbxtxiw.vmm\001.exe5⤵
- Executes dropped EXE
PID:6788
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\lj033fl1.r3e\GcleanerEU.exe /eufive & exit4⤵PID:1724
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2rpma51p.wkd\installer.exe /qn CAMPAIGN="654" & exit4⤵PID:6828
-
C:\Users\Admin\AppData\Local\Temp\2rpma51p.wkd\installer.exeC:\Users\Admin\AppData\Local\Temp\2rpma51p.wkd\installer.exe /qn CAMPAIGN="654"5⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:748
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\oxtrgze4.gqy\gaoou.exe & exit4⤵PID:5752
-
C:\Users\Admin\AppData\Local\Temp\oxtrgze4.gqy\gaoou.exeC:\Users\Admin\AppData\Local\Temp\oxtrgze4.gqy\gaoou.exe5⤵PID:3840
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:7156
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:1720
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\cg42p2nr.uyc\Setup3310.exe /Verysilent /subid=623 & exit4⤵PID:6368
-
C:\Users\Admin\AppData\Local\Temp\cg42p2nr.uyc\Setup3310.exeC:\Users\Admin\AppData\Local\Temp\cg42p2nr.uyc\Setup3310.exe /Verysilent /subid=6235⤵PID:6664
-
C:\Users\Admin\AppData\Local\Temp\is-9M3ST.tmp\Setup3310.tmp"C:\Users\Admin\AppData\Local\Temp\is-9M3ST.tmp\Setup3310.tmp" /SL5="$202DA,138429,56832,C:\Users\Admin\AppData\Local\Temp\cg42p2nr.uyc\Setup3310.exe" /Verysilent /subid=6236⤵PID:7156
-
C:\Users\Admin\AppData\Local\Temp\is-J1OFA.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-J1OFA.tmp\Setup.exe" /Verysilent7⤵PID:5252
-
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ftxqzuyd.0id\google-game.exe & exit4⤵PID:6728
-
C:\Users\Admin\AppData\Local\Temp\ftxqzuyd.0id\google-game.exeC:\Users\Admin\AppData\Local\Temp\ftxqzuyd.0id\google-game.exe5⤵PID:2488
-
C:\Windows\SysWOW64\rUNdlL32.eXe"C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",get6⤵PID:7476
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\f2h3enxy.1lc\GcleanerWW.exe /mixone & exit4⤵PID:5100
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5rnmomas.nge\005.exe & exit4⤵PID:5588
-
C:\Users\Admin\AppData\Local\Temp\5rnmomas.nge\005.exeC:\Users\Admin\AppData\Local\Temp\5rnmomas.nge\005.exe5⤵PID:4976
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\ez0mx4uh.ig5\toolspab1.exe & exit4⤵PID:5732
-
C:\Users\Admin\AppData\Local\Temp\ez0mx4uh.ig5\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ez0mx4uh.ig5\toolspab1.exe5⤵PID:7940
-
C:\Users\Admin\AppData\Local\Temp\ez0mx4uh.ig5\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\ez0mx4uh.ig5\toolspab1.exe6⤵PID:7436
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\0kg2tg32.p3z\702564a0.exe & exit4⤵PID:4888
-
C:\Users\Admin\AppData\Local\Temp\0kg2tg32.p3z\702564a0.exeC:\Users\Admin\AppData\Local\Temp\0kg2tg32.p3z\702564a0.exe5⤵PID:7088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 7088 -s 4806⤵
- Program crash
PID:4636
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\tostlbn2.nly\installer.exe /qn CAMPAIGN="654" & exit4⤵PID:7076
-
C:\Users\Admin\AppData\Local\Temp\tostlbn2.nly\installer.exeC:\Users\Admin\AppData\Local\Temp\tostlbn2.nly\installer.exe /qn CAMPAIGN="654"5⤵PID:7672
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:5316
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:4664
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7364
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4324
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4284
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:4440
-
C:\Users\Admin\AppData\Local\Temp\4B6C.exeC:\Users\Admin\AppData\Local\Temp\4B6C.exe1⤵PID:2388
-
C:\Users\Admin\AppData\Local\Temp\4B6C.exeC:\Users\Admin\AppData\Local\Temp\4B6C.exe2⤵PID:7080
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\d50e6a7b-3bb2-4a20-836e-1afb851ca3a2" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:1408
-
-
C:\Users\Admin\AppData\Local\Temp\4B6C.exe"C:\Users\Admin\AppData\Local\Temp\4B6C.exe" --Admin IsNotAutoStart IsNotTask3⤵PID:3832
-
C:\Users\Admin\AppData\Local\Temp\4B6C.exe"C:\Users\Admin\AppData\Local\Temp\4B6C.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:4464
-
C:\Users\Admin\AppData\Local\20b259ae-a013-4838-8929-bffc1d62ccca\updatewin1.exe"C:\Users\Admin\AppData\Local\20b259ae-a013-4838-8929-bffc1d62ccca\updatewin1.exe"5⤵PID:6056
-
-
C:\Users\Admin\AppData\Local\20b259ae-a013-4838-8929-bffc1d62ccca\updatewin2.exe"C:\Users\Admin\AppData\Local\20b259ae-a013-4838-8929-bffc1d62ccca\updatewin2.exe"5⤵PID:200
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7423.exeC:\Users\Admin\AppData\Local\Temp\7423.exe1⤵PID:5980
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 7423.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7423.exe" & del C:\ProgramData\*.dll & exit2⤵PID:5836
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 7423.exe /f3⤵
- Loads dropped DLL
- Kills process with taskkill
PID:4248
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:4200
-
-
-
C:\Users\Admin\AppData\Local\Temp\8E44.exeC:\Users\Admin\AppData\Local\Temp\8E44.exe1⤵PID:4444
-
C:\Users\Admin\AppData\Local\Temp\B0F0.exeC:\Users\Admin\AppData\Local\Temp\B0F0.exe1⤵PID:8064
-
C:\Users\Admin\AppData\Local\Temp\E109.exeC:\Users\Admin\AppData\Local\Temp\E109.exe1⤵PID:4724
-
C:\Users\Admin\AppData\Local\Temp\EE49.exeC:\Users\Admin\AppData\Local\Temp\EE49.exe1⤵PID:4612
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4612 -s 7642⤵
- Program crash
PID:7204
-