fickerstealer | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

Processes:

RlzUhV4Urpr7VR515zqFuuJB.exeuJZgG49bWBiVML2TTFKoBU1L.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RlzUhV4Urpr7VR515zqFuuJB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RlzUhV4Urpr7VR515zqFuuJB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	uJZgG49bWBiVML2TTFKoBU1L.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	uJZgG49bWBiVML2TTFKoBU1L.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

sonia_5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	sonia_5.exe

Drops startup file 2 IoCs

Processes:

Sensitive.exe.comAcre.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url	Sensitive.exe.com
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com

Loads dropped DLL 20 IoCs

Processes:

setup_install.exesonia_2.exerundll32.exesonia_3.exerundll32.exe_Hk_I1BBmKn1Vw2kF628VULx.exerSurnp45pHdMAv3NZL04aVwB.exerundll32.exeuwafrfuuwafrfuuwafrfu

pid	process
3368	setup_install.exe
3368	setup_install.exe
3368	setup_install.exe
3368	setup_install.exe
3368	setup_install.exe
3368	setup_install.exe
3368	setup_install.exe
3208	sonia_2.exe
2812	rundll32.exe
2904	sonia_3.exe
2904	sonia_3.exe
5916	rundll32.exe
3732	_Hk_I1BBmKn1Vw2kF628VULx.exe
3732	_Hk_I1BBmKn1Vw2kF628VULx.exe
4388	rSurnp45pHdMAv3NZL04aVwB.exe
4388	rSurnp45pHdMAv3NZL04aVwB.exe
6008	rundll32.exe
4224	uwafrfu
4912	uwafrfu
5556	uwafrfu

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\RlzUhV4Urpr7VR515zqFuuJB.exe	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

sonia_6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

RlzUhV4Urpr7VR515zqFuuJB.exeuJZgG49bWBiVML2TTFKoBU1L.exeGPjlCF9eLbxsJvaLedZaeh35.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	RlzUhV4Urpr7VR515zqFuuJB.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	uJZgG49bWBiVML2TTFKoBU1L.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	GPjlCF9eLbxsJvaLedZaeh35.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 6 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

16 ipinfo.io
17 ipinfo.io
18 ip-api.com
24 api.db-ip.com
25 api.db-ip.com
179 api.ipify.org

flow	ioc
16	ipinfo.io
17	ipinfo.io
18	ip-api.com
24	api.db-ip.com
25	api.db-ip.com
179	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 26C58FE15500F9A6	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

RlzUhV4Urpr7VR515zqFuuJB.exeuJZgG49bWBiVML2TTFKoBU1L.exe

pid process

5104 RlzUhV4Urpr7VR515zqFuuJB.exe
4972 uJZgG49bWBiVML2TTFKoBU1L.exe

pid	process
5104	RlzUhV4Urpr7VR515zqFuuJB.exe
4972	uJZgG49bWBiVML2TTFKoBU1L.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

svchost.exeOLKbrowser.exehildF6CZrycFYwEX6KrOZgeB.exe_Hk_I1BBmKn1Vw2kF628VULx.exeZi4wN1CZ9w00UDHDqDu8SsRT.exezb_X413uFOfmX0_FYIcBDgdM.exeIQ5ZTk5qWBx03JJRSs1nsjjK.exe1234.exeSensitive.exe.comAcre.exe.com

description	pid	process	target process
PID 1832 set thread context of 4064	1832	svchost.exe	svchost.exe
PID 4540 set thread context of 5072	4540	OLKbrowser.exe	OLKbrowser.exe
PID 4148 set thread context of 2068	4148	hildF6CZrycFYwEX6KrOZgeB.exe	hildF6CZrycFYwEX6KrOZgeB.exe
PID 2156 set thread context of 3732	2156	_Hk_I1BBmKn1Vw2kF628VULx.exe	_Hk_I1BBmKn1Vw2kF628VULx.exe
PID 4644 set thread context of 4380	4644	Zi4wN1CZ9w00UDHDqDu8SsRT.exe	Zi4wN1CZ9w00UDHDqDu8SsRT.exe
PID 5016 set thread context of 4228	5016	zb_X413uFOfmX0_FYIcBDgdM.exe	zb_X413uFOfmX0_FYIcBDgdM.exe
PID 5048 set thread context of 2452	5048	IQ5ZTk5qWBx03JJRSs1nsjjK.exe	IQ5ZTk5qWBx03JJRSs1nsjjK.exe
PID 5300 set thread context of 6324	5300	1234.exe	1234.exe
PID 5680 set thread context of 6676	5680	Sensitive.exe.com	RegAsm.exe
PID 5900 set thread context of 7008	5900	Acre.exe.com	RegAsm.exe

Drops file in Program Files directory 7 IoCs

Processes:

VgAdtmBA8G2ht4EFrVua70DZ.exe

description	ioc	process
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	VgAdtmBA8G2ht4EFrVua70DZ.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	VgAdtmBA8G2ht4EFrVua70DZ.exe

Drops file in Windows directory 3 IoCs

Processes:

setup 326.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 10 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1844	4828	WerFault.exe	setup.exe
3144	4828	WerFault.exe	setup.exe
3832	4828	WerFault.exe	setup.exe
4420	4828	WerFault.exe	setup.exe
3020	4828	WerFault.exe	setup.exe
4968	4828	WerFault.exe	setup.exe
1248	4580	WerFault.exe	Chrome Update.exe
5088	4828	WerFault.exe	setup.exe
6132	6008	WerFault.exe	rundll32.exe
6524	1840	WerFault.exe	bLPISIk71TcfMxaZOC06qwfj.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exeuwafrfuuwafrfuuwafrfu

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	uwafrfu

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exeIQ5ZTk5qWBx03JJRSs1nsjjK.exerSurnp45pHdMAv3NZL04aVwB.exesonia_3.exe_Hk_I1BBmKn1Vw2kF628VULx.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	IQ5ZTk5qWBx03JJRSs1nsjjK.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	rSurnp45pHdMAv3NZL04aVwB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	rSurnp45pHdMAv3NZL04aVwB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sonia_3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sonia_3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	IQ5ZTk5qWBx03JJRSs1nsjjK.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_Hk_I1BBmKn1Vw2kF628VULx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_Hk_I1BBmKn1Vw2kF628VULx.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

3884 timeout.exe
4512 timeout.exe
5972 timeout.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

576 taskkill.exe
5944 taskkill.exe
4112 taskkill.exe
796 taskkill.exe

pid	process
3884	timeout.exe
4512	timeout.exe
5972	timeout.exe

pid	process
576	taskkill.exe
5944	taskkill.exe
4112	taskkill.exe
796	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

bLPISIk71TcfMxaZOC06qwfj.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2791 = "Novosibirsk Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2451 = "Saint Pierre Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-372 = "Jerusalem Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-172 = "Central Standard Time (Mexico)"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	bLPISIk71TcfMxaZOC06qwfj.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	bLPISIk71TcfMxaZOC06qwfj.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 0000000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$blogger	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\7289246C77593EBF	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ffa658f2937dd701	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000070964d0f729b833172583f3385bd224330baa4a926404af34f3ac79fdda737bb394ba08e199de8c97cf378431c4be4402b42cce50303734fe5a3	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "2436"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ee4052da937dd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "5"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension = "{092C5EFC-DFD6-41E7-9845-4402632A65A0}"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\AllComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url1 = "https://www.facebook.com/"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8bc108e6937dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658 = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

4868 regedit.exe
4336 regedit.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

4324 PING.EXE
6020 PING.EXE

pid	process
4868	regedit.exe
4336	regedit.exe

pid	process
4324	PING.EXE
6020	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sonia_2.exerundll32.exesvchost.exe

pid	process
3208	sonia_2.exe
3208	sonia_2.exe
2812	rundll32.exe
2812	rundll32.exe
1832	svchost.exe
1832	svchost.exe
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008
3008

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3008
Suspicious behavior: MapViewOfSection 8 IoCs

Processes:

sonia_2.exeMicrosoftEdgeCP.exeuwafrfuSensitive.exe.comAcre.exe.comuwafrfuuwafrfu

pid process

3208 sonia_2.exe
5372 MicrosoftEdgeCP.exe
5372 MicrosoftEdgeCP.exe
4224 uwafrfu
5680 Sensitive.exe.com
5900 Acre.exe.com
4912 uwafrfu
5556 uwafrfu

pid	process
3008

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_4.exerundll32.exesvchost.exen975h0JXF5bS5cKHU1bM3ctS.exe

description	pid	process
Token: SeDebugPrivilege	3144	sonia_4.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	1832	svchost.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeDebugPrivilege	2812	rundll32.exe
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeCreateTokenPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeAssignPrimaryTokenPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeLockMemoryPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeIncreaseQuotaPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeMachineAccountPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeTcbPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeSecurityPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeTakeOwnershipPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeLoadDriverPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeSystemProfilePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeSystemtimePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeProfSingleProcessPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeIncBasePriorityPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeCreatePagefilePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeCreatePermanentPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeBackupPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeRestorePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeShutdownPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeDebugPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeAuditPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeSystemEnvironmentPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeChangeNotifyPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeRemoteShutdownPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeUndockPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeSyncAgentPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeEnableDelegationPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeManageVolumePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeImpersonatePrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeCreateGlobalPrivilege	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: 31	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: 32	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: 33	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: 34	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: 35	5092	n975h0JXF5bS5cKHU1bM3ctS.exe
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008
Token: SeCreatePagefilePrivilege	3008
Token: SeShutdownPrivilege	3008

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3008
3008
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3008
5948 MicrosoftEdge.exe
5372 MicrosoftEdgeCP.exe
5372 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3008

pid	process
3008
3008

pid	process
3008
5948	MicrosoftEdge.exe
5372	MicrosoftEdgeCP.exe
5372	MicrosoftEdgeCP.exe

pid	process
3008

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8 (4).exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exesonia_4.exerUNdlL32.eXerundll32.exesvchost.exe

description	pid	process	target process
PID 1440 wrote to memory of 2708	1440	8 (4).exe	setup_installer.exe
PID 1440 wrote to memory of 2708	1440	8 (4).exe	setup_installer.exe
PID 1440 wrote to memory of 2708	1440	8 (4).exe	setup_installer.exe
PID 2708 wrote to memory of 3368	2708	setup_installer.exe	setup_install.exe
PID 2708 wrote to memory of 3368	2708	setup_installer.exe	setup_install.exe
PID 2708 wrote to memory of 3368	2708	setup_installer.exe	setup_install.exe
PID 3368 wrote to memory of 1504	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 1504	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 1504	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2264	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2264	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2264	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2284	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2284	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2284	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2320	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2320	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 2320	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3792	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3792	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3792	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3528	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3528	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3528	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3956	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3956	3368	setup_install.exe	cmd.exe
PID 3368 wrote to memory of 3956	3368	setup_install.exe	cmd.exe
PID 2264 wrote to memory of 3208	2264	cmd.exe	sonia_2.exe
PID 2264 wrote to memory of 3208	2264	cmd.exe	sonia_2.exe
PID 2264 wrote to memory of 3208	2264	cmd.exe	sonia_2.exe
PID 2320 wrote to memory of 3144	2320	cmd.exe	sonia_4.exe
PID 2320 wrote to memory of 3144	2320	cmd.exe	sonia_4.exe
PID 1504 wrote to memory of 576	1504	cmd.exe	sonia_1.exe
PID 1504 wrote to memory of 576	1504	cmd.exe	sonia_1.exe
PID 1504 wrote to memory of 576	1504	cmd.exe	sonia_1.exe
PID 2284 wrote to memory of 2904	2284	cmd.exe	sonia_3.exe
PID 2284 wrote to memory of 2904	2284	cmd.exe	sonia_3.exe
PID 2284 wrote to memory of 2904	2284	cmd.exe	sonia_3.exe
PID 3528 wrote to memory of 3116	3528	cmd.exe	sonia_6.exe
PID 3528 wrote to memory of 3116	3528	cmd.exe	sonia_6.exe
PID 3528 wrote to memory of 3116	3528	cmd.exe	sonia_6.exe
PID 3792 wrote to memory of 3936	3792	cmd.exe	sonia_5.exe
PID 3792 wrote to memory of 3936	3792	cmd.exe	sonia_5.exe
PID 3792 wrote to memory of 3936	3792	cmd.exe	sonia_5.exe
PID 576 wrote to memory of 1160	576	sonia_1.exe	sonia_1.exe
PID 576 wrote to memory of 1160	576	sonia_1.exe	sonia_1.exe
PID 576 wrote to memory of 1160	576	sonia_1.exe	sonia_1.exe
PID 3116 wrote to memory of 1840	3116	sonia_6.exe	jfiag3g_gg.exe
PID 3116 wrote to memory of 1840	3116	sonia_6.exe	jfiag3g_gg.exe
PID 3116 wrote to memory of 1840	3116	sonia_6.exe	jfiag3g_gg.exe
PID 3144 wrote to memory of 3016	3144	sonia_4.exe	LzmwAqmV.exe
PID 3144 wrote to memory of 3016	3144	sonia_4.exe	LzmwAqmV.exe
PID 3144 wrote to memory of 3016	3144	sonia_4.exe	LzmwAqmV.exe
PID 2376 wrote to memory of 2812	2376	rUNdlL32.eXe	rundll32.exe
PID 2376 wrote to memory of 2812	2376	rUNdlL32.eXe	rundll32.exe
PID 2376 wrote to memory of 2812	2376	rUNdlL32.eXe	rundll32.exe
PID 2812 wrote to memory of 1832	2812	rundll32.exe	svchost.exe
PID 1832 wrote to memory of 4064	1832	svchost.exe	svchost.exe
PID 1832 wrote to memory of 4064	1832	svchost.exe	svchost.exe
PID 1832 wrote to memory of 4064	1832	svchost.exe	svchost.exe
PID 2812 wrote to memory of 2664	2812	rundll32.exe	svchost.exe
PID 2812 wrote to memory of 1020	2812	rundll32.exe	svchost.exe
PID 2812 wrote to memory of 2464	2812	rundll32.exe	svchost.exe
PID 2812 wrote to memory of 2432	2812	rundll32.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2756

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2744

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2664

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2464

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2432

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1904

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1428

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1324

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1204

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:924

C:\Users\Admin\AppData\Roaming\uwafrfu
C:\Users\Admin\AppData\Roaming\uwafrfu
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4224

C:\Users\Admin\AppData\Roaming\uwafrfu
C:\Users\Admin\AppData\Roaming\uwafrfu
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4912

C:\Users\Admin\AppData\Roaming\uwafrfu
C:\Users\Admin\AppData\Roaming\uwafrfu
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5556

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1020

C:\Users\Admin\AppData\Local\Temp\8 (4).exe
"C:\Users\Admin\AppData\Local\Temp\8 (4).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1440

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2708

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3368

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1504

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:576

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_1.exe" -a
6⤵
- Executes dropped EXE
PID:1160

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2284

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
PID:2904

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_3.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:4436

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sonia_3.exe /f
7⤵
- Kills process with taskkill
PID:576

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:3884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2320

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3144

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:3016

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4884

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4428

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:5412

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:6416

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4540

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
8⤵
PID:4972

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
8⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4656

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626805088 0
8⤵
- Executes dropped EXE
PID:4788

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 776
8⤵
- Program crash
PID:1844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 940
8⤵
- Program crash
PID:3144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 920
8⤵
- Program crash
PID:3832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 960
8⤵
- Program crash
PID:4420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 964
8⤵
- Program crash
PID:3020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 932
8⤵
- Program crash
PID:4968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4828 -s 1064
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5088

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
7⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
8⤵
- Executes dropped EXE
PID:3556

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
7⤵
- Executes dropped EXE
PID:4580

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4580 -s 1004
8⤵
- Program crash
PID:1248

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3528

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3792

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2264

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4064

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_2.exe
sonia_2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3208

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_5.exe
sonia_5.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
PID:3936

C:\Users\Admin\Documents\Z47jhUQuX4mcaEebOwcWcYtJ.exe
"C:\Users\Admin\Documents\Z47jhUQuX4mcaEebOwcWcYtJ.exe"
2⤵
- Executes dropped EXE
PID:5020

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
3⤵
PID:2356

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
PID:4480

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
5⤵
PID:5380

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
Acre.exe.com k
5⤵
- Executes dropped EXE
PID:3596

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
6⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5900

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
7⤵
PID:7008

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
5⤵
- Runs ping.exe
PID:4324

C:\Users\Admin\Documents\NI6v1M277DUWFVuCaznsp5dV.exe
"C:\Users\Admin\Documents\NI6v1M277DUWFVuCaznsp5dV.exe"
2⤵
- Executes dropped EXE
PID:5008

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:5668

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4280

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4692

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
- Executes dropped EXE
PID:4816

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5560

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:4684

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:5936

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
3⤵
PID:6424

C:\Users\Admin\Documents\RlzUhV4Urpr7VR515zqFuuJB.exe
"C:\Users\Admin\Documents\RlzUhV4Urpr7VR515zqFuuJB.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5104

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5300

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
4⤵
PID:6324

C:\Users\Admin\Documents\n975h0JXF5bS5cKHU1bM3ctS.exe
"C:\Users\Admin\Documents\n975h0JXF5bS5cKHU1bM3ctS.exe"
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5092

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
3⤵
PID:5764

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
4⤵
- Kills process with taskkill
PID:5944

C:\Users\Admin\Documents\wmQOQrldn1PafvdgjmIxpz0W.exe
"C:\Users\Admin\Documents\wmQOQrldn1PafvdgjmIxpz0W.exe"
2⤵
- Executes dropped EXE
PID:1716

C:\Users\Admin\Documents\VgAdtmBA8G2ht4EFrVua70DZ.exe
"C:\Users\Admin\Documents\VgAdtmBA8G2ht4EFrVua70DZ.exe"
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:2336

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
3⤵
PID:3016

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
4⤵
PID:4496

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
4⤵
- Runs .reg file with regedit
PID:4868

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
4⤵
- Runs .reg file with regedit
PID:4336

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
3⤵
- Executes dropped EXE
PID:2288

C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
"C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2156

C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3732

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im _Hk_I1BBmKn1Vw2kF628VULx.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe" & del C:\ProgramData\*.dll & exit
4⤵
PID:4272

C:\Windows\SysWOW64\taskkill.exe
taskkill /im _Hk_I1BBmKn1Vw2kF628VULx.exe /f
5⤵
- Kills process with taskkill
PID:4112

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
5⤵
- Delays execution with timeout.exe
PID:4512

C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
3⤵
- Executes dropped EXE
PID:3092

C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
C:\Users\Admin\Documents\_Hk_I1BBmKn1Vw2kF628VULx.exe
3⤵
- Executes dropped EXE
PID:3160

C:\Users\Admin\Documents\hildF6CZrycFYwEX6KrOZgeB.exe
"C:\Users\Admin\Documents\hildF6CZrycFYwEX6KrOZgeB.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4148

C:\Users\Admin\Documents\hildF6CZrycFYwEX6KrOZgeB.exe
C:\Users\Admin\Documents\hildF6CZrycFYwEX6KrOZgeB.exe
3⤵
- Executes dropped EXE
PID:2068

C:\Users\Admin\Documents\p8s5ZTFP1pS9Rk1kfG2RvhCs.exe
"C:\Users\Admin\Documents\p8s5ZTFP1pS9Rk1kfG2RvhCs.exe"
2⤵
- Executes dropped EXE
PID:5040

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm
3⤵
PID:2332

C:\Windows\SysWOW64\cmd.exe
cmd
4⤵
PID:5160

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm
5⤵
PID:4276

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
Sensitive.exe.com p
5⤵
- Executes dropped EXE
PID:5912

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
6⤵
- Executes dropped EXE
PID:4996

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
7⤵
- Executes dropped EXE
PID:5192

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
8⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5680

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
9⤵
PID:6676

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
5⤵
- Runs ping.exe
PID:6020

C:\Users\Admin\Documents\pTNmKCGYp5SMLh5kQwSkaN8J.exe
"C:\Users\Admin\Documents\pTNmKCGYp5SMLh5kQwSkaN8J.exe"
2⤵
- Executes dropped EXE
PID:4600

C:\Users\Admin\AppData\Roaming\4028738.exe
"C:\Users\Admin\AppData\Roaming\4028738.exe"
3⤵
- Executes dropped EXE
PID:5508

C:\Users\Admin\AppData\Roaming\7823546.exe
"C:\Users\Admin\AppData\Roaming\7823546.exe"
3⤵
- Executes dropped EXE
PID:5564

C:\Users\Admin\Documents\Zi4wN1CZ9w00UDHDqDu8SsRT.exe
"C:\Users\Admin\Documents\Zi4wN1CZ9w00UDHDqDu8SsRT.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4644

C:\Users\Admin\Documents\Zi4wN1CZ9w00UDHDqDu8SsRT.exe
C:\Users\Admin\Documents\Zi4wN1CZ9w00UDHDqDu8SsRT.exe
3⤵
- Executes dropped EXE
PID:4380

C:\Users\Admin\Documents\rSurnp45pHdMAv3NZL04aVwB.exe
"C:\Users\Admin\Documents\rSurnp45pHdMAv3NZL04aVwB.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4388

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im rSurnp45pHdMAv3NZL04aVwB.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\rSurnp45pHdMAv3NZL04aVwB.exe" & del C:\ProgramData\*.dll & exit
3⤵
PID:4332

C:\Windows\SysWOW64\taskkill.exe
taskkill /im rSurnp45pHdMAv3NZL04aVwB.exe /f
4⤵
- Kills process with taskkill
PID:796

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
4⤵
- Delays execution with timeout.exe
PID:5972

C:\Users\Admin\Documents\GPjlCF9eLbxsJvaLedZaeh35.exe
"C:\Users\Admin\Documents\GPjlCF9eLbxsJvaLedZaeh35.exe"
2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:3924

C:\Users\Admin\Documents\zb_X413uFOfmX0_FYIcBDgdM.exe
"C:\Users\Admin\Documents\zb_X413uFOfmX0_FYIcBDgdM.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5016

C:\Users\Admin\Documents\zb_X413uFOfmX0_FYIcBDgdM.exe
C:\Users\Admin\Documents\zb_X413uFOfmX0_FYIcBDgdM.exe
3⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\Documents\IQ5ZTk5qWBx03JJRSs1nsjjK.exe
"C:\Users\Admin\Documents\IQ5ZTk5qWBx03JJRSs1nsjjK.exe"
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5048

C:\Users\Admin\Documents\IQ5ZTk5qWBx03JJRSs1nsjjK.exe
"C:\Users\Admin\Documents\IQ5ZTk5qWBx03JJRSs1nsjjK.exe"
3⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2452

C:\Users\Admin\Documents\uJZgG49bWBiVML2TTFKoBU1L.exe
"C:\Users\Admin\Documents\uJZgG49bWBiVML2TTFKoBU1L.exe"
2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4972

C:\Users\Admin\Documents\bLPISIk71TcfMxaZOC06qwfj.exe
"C:\Users\Admin\Documents\bLPISIk71TcfMxaZOC06qwfj.exe"
2⤵
- Executes dropped EXE
PID:1840

C:\Users\Admin\Documents\bLPISIk71TcfMxaZOC06qwfj.exe
"C:\Users\Admin\Documents\bLPISIk71TcfMxaZOC06qwfj.exe"
3⤵
- Modifies data under HKEY_USERS
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1840 -s 848
3⤵
- Program crash
PID:6524

C:\Users\Admin\Documents\FK_WzwUdnhP3jKsIyeARuWxE.exe
"C:\Users\Admin\Documents\FK_WzwUdnhP3jKsIyeARuWxE.exe"
2⤵
- Executes dropped EXE
PID:4248

C:\Users\Admin\Documents\FK_WzwUdnhP3jKsIyeARuWxE.exe
"C:\Users\Admin\Documents\FK_WzwUdnhP3jKsIyeARuWxE.exe" -a
3⤵
- Executes dropped EXE
PID:5644

C:\Users\Admin\AppData\Local\Temp\7zS49AD6EC4\sonia_6.exe
sonia_6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3116

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:1840

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:188

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5776

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5972

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2376

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5896

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5916

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5660

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5960

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:6008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 6008 -s 624
3⤵
- Program crash
PID:6132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5948

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:4988

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5372

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:4892

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6436

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:7132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Install Root Certificate

T1130

Modify Registry

Virtualization/Sandbox Evasion

T1497

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery