Overview
overview
10Static
static
8 (1).exe
windows10_x64
108 (10).exe
windows10_x64
108 (11).exe
windows10_x64
108 (12).exe
windows10_x64
108 (13).exe
windows10_x64
108 (14).exe
windows10_x64
108 (15).exe
windows10_x64
108 (16).exe
windows10_x64
108 (17).exe
windows10_x64
108 (18).exe
windows10_x64
108 (19).exe
windows10_x64
108 (2).exe
windows10_x64
108 (20).exe
windows10_x64
108 (21).exe
windows10_x64
108 (22).exe
windows10_x64
108 (23).exe
windows10_x64
108 (24).exe
windows10_x64
108 (25).exe
windows10_x64
108 (26).exe
windows10_x64
108 (27).exe
windows10_x64
108 (28).exe
windows10_x64
108 (29).exe
windows10_x64
108 (3).exe
windows10_x64
108 (30).exe
windows10_x64
108 (31).exe
windows10_x64
108 (4).exe
windows10_x64
108 (5).exe
windows10_x64
108 (6).exe
windows10_x64
108 (7).exe
windows10_x64
108 (8).exe
windows10_x64
108 (9).exe
windows10_x64
108.exe
windows10_x64
10Resubmissions
13-08-2021 10:16
210813-wpta271jdx 1008-08-2021 23:00
210808-fgs5g9pxfs 1007-08-2021 23:12
210807-g2jw1lmd4a 1007-08-2021 16:10
210807-51nhct4kfx 1006-08-2021 23:43
210806-gc2271nxwj 1006-08-2021 06:00
210806-f443x39x8a 1005-08-2021 17:08
210805-97y6banvvx 1004-08-2021 17:25
210804-hkxx2ntr8x 1004-08-2021 12:12
210804-rjbg4b4y7n 1003-08-2021 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
1804s -
max time network
1812s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-07-2021 16:13
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win10v20210408
Behavioral task
behavioral2
Sample
8 (10).exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
8 (11).exe
Resource
win10v20210408
Behavioral task
behavioral4
Sample
8 (12).exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
8 (13).exe
Resource
win10v20210408
Behavioral task
behavioral6
Sample
8 (14).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
8 (15).exe
Resource
win10v20210410
Behavioral task
behavioral8
Sample
8 (16).exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
8 (17).exe
Resource
win10v20210410
Behavioral task
behavioral10
Sample
8 (18).exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
8 (19).exe
Resource
win10v20210410
Behavioral task
behavioral12
Sample
8 (2).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
8 (20).exe
Resource
win10v20210410
Behavioral task
behavioral14
Sample
8 (21).exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
8 (22).exe
Resource
win10v20210408
Behavioral task
behavioral16
Sample
8 (23).exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
8 (24).exe
Resource
win10v20210408
Behavioral task
behavioral18
Sample
8 (25).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
8 (26).exe
Resource
win10v20210408
Behavioral task
behavioral20
Sample
8 (27).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
8 (28).exe
Resource
win10v20210410
Behavioral task
behavioral22
Sample
8 (29).exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
8 (3).exe
Resource
win10v20210410
Behavioral task
behavioral24
Sample
8 (30).exe
Resource
win10v20210408
Behavioral task
behavioral25
Sample
8 (31).exe
Resource
win10v20210410
Behavioral task
behavioral26
Sample
8 (4).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
8 (5).exe
Resource
win10v20210410
Behavioral task
behavioral28
Sample
8 (6).exe
Resource
win10v20210410
Behavioral task
behavioral29
Sample
8 (7).exe
Resource
win10v20210408
Behavioral task
behavioral30
Sample
8 (8).exe
Resource
win10v20210410
Behavioral task
behavioral31
Sample
8 (9).exe
Resource
win10v20210408
General
-
Target
8 (16).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
redline
2007
37.1.219.52:6534
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
AniNEW
akedauiver.xyz:80
Extracted
redline
sel17
dwarimlari.xyz:80
Extracted
vidar
39.6
903
https://sslamlssa1.tumblr.com/
-
profile_id
903
Extracted
vidar
39.7
865
https://shpak125.tumblr.com/
-
profile_id
865
Extracted
fickerstealer
37.0.8.225:80
Extracted
metasploit
windows/single_exec
Signatures
-
Fickerstealer
Ficker is an infostealer written in Rust and ASM.
-
Glupteba Payload 2 IoCs
resource yara_rule behavioral8/memory/4732-410-0x0000000001670000-0x0000000001F96000-memory.dmp family_glupteba behavioral8/memory/4732-417-0x0000000000400000-0x0000000000D41000-memory.dmp family_glupteba -
MetaSploit
Detected malicious payload which is part of the Metasploit Framework, likely generated with msfvenom or similar.
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3256 1120 rUNdlL32.eXe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5776 1120 rUNdlL32.eXe 95 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6040 1120 rUNdlL32.eXe 95 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 8 IoCs
resource yara_rule behavioral8/files/0x00020000000155fe-255.dat family_redline behavioral8/files/0x00020000000155fe-253.dat family_redline behavioral8/memory/5096-306-0x0000000000417E1A-mapping.dmp family_redline behavioral8/memory/5096-303-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral8/memory/4588-323-0x0000000000417DEA-mapping.dmp family_redline behavioral8/memory/4588-322-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral8/memory/4920-366-0x0000000000417DEE-mapping.dmp family_redline behavioral8/memory/4816-379-0x0000000000417DFA-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral8/files/0x000300000001ab7b-283.dat family_socelars behavioral8/files/0x000300000001ab7b-282.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 420 created 2332 420 WerFault.exe 88 PID 3696 created 416 3696 WerFault.exe 115 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 6484 created 4732 6484 svchost.exe 123 -
resource yara_rule behavioral8/files/0x00020000000155fe-255.dat Redline_stealer2 behavioral8/files/0x00020000000155fe-253.dat Redline_stealer2 behavioral8/memory/5096-306-0x0000000000417E1A-mapping.dmp Redline_stealer2 behavioral8/memory/5096-303-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral8/memory/4588-323-0x0000000000417DEA-mapping.dmp Redline_stealer2 behavioral8/memory/4588-322-0x0000000000400000-0x000000000041E000-memory.dmp Redline_stealer2 behavioral8/memory/4920-366-0x0000000000417DEE-mapping.dmp Redline_stealer2 behavioral8/memory/4816-379-0x0000000000417DFA-mapping.dmp Redline_stealer2 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 1 IoCs
resource yara_rule behavioral8/memory/4868-389-0x00000000008F0000-0x0000000000A3A000-memory.dmp Nirsoft -
Vidar Stealer 4 IoCs
resource yara_rule behavioral8/memory/2332-192-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar behavioral8/memory/4896-364-0x000000000046B76D-mapping.dmp family_vidar behavioral8/memory/4896-369-0x0000000000400000-0x00000000004A1000-memory.dmp family_vidar behavioral8/memory/4868-391-0x0000000000400000-0x00000000008EC000-memory.dmp family_vidar -
resource yara_rule behavioral8/files/0x000100000001ab7f-118.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7b-122.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7d-128.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7d-129.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7a-125.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7a-124.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7b-123.dat aspack_v212_v242 behavioral8/files/0x000100000001ab7f-119.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 3776 setup_installer.exe 3364 setup_install.exe 1048 sonia_5.exe 500 sonia_2.exe 3924 sonia_1.exe 2332 sonia_3.exe 4056 sonia_4.exe 3916 sonia_6.exe 2880 sonia_1.exe 2936 jfiag3g_gg.exe 948 LzmwAqmV.exe 4408 jhuuee.exe 4576 OLKbrowser.exe 4708 setup 326.exe 4780 GsKIbaZinERmqiQo2bbcT__z.exe 4792 wnRPIY7Hs5vIygbeuxI2wM0_.exe 4860 A6QLNHgtE7z0Hz63SvwAEmcF.exe 4824 winnetdriv.exe 4952 lEsjNHNB7SaR77gHJyF_aarp.exe 5004 S7LnygKf1MypZwcoNyLV2HFd.exe 5056 taskkill.exe 820 a9gDqMHrxPYaWrUxMVsbW1V2.exe 4224 1Pv6W4BRy4b0QGmG6QlWYpm1.exe 4384 Conhost.exe 416 setup.exe 4164 jfiag3g_gg.exe 2572 117D33zwMB8bPOfXegmrHx4m.exe 5096 OLKbrowser.exe 4348 zhangd.exe 4868 v5KhW_TcnpH5aYBa8g3Ln7GX.exe 4732 WaPTXmcUMgAUnP4pSXYpr6ff.exe 4800 WerFault.exe 4588 GsKIbaZinERmqiQo2bbcT__z.exe 5080 Chrome Update.exe 4460 V2ZsHh5vdIchwQDjPx49zRCQ.exe 4384 Conhost.exe 2436 UkmTPs0rFNG9FFsKCk78g0l2.exe 4444 j56hAiNU2FEkLEohS7jxKWsK.exe 4896 117D33zwMB8bPOfXegmrHx4m.exe 4920 2qODuGtpFMRxbifv7pBny02B.exe 584 jfiag3g_gg.exe 4656 WwFXdImRtQ9aqwATUUB7nRm1.exe 2100 ISRaOOYqZQFkJ7f3r0UDpoqM.exe 4816 V2ZsHh5vdIchwQDjPx49zRCQ.exe 4764 PING.EXE 1428 Updater.exe 5172 zhangd.exe 5576 ISRaOOYqZQFkJ7f3r0UDpoqM.exe 5992 11111.exe 6100 3138486.exe 5124 7099489.exe 5556 Acre.exe.com 3900 Acre.exe.com 5892 11111.exe 5908 Sensitive.exe.com 5952 1234.exe 5308 Acre.exe.com 5424 Sensitive.exe.com 5852 MicrosoftEdgeCP.exe 4012 Sensitive.exe.com 6140 Acre.exe.com 4212 Sensitive.exe.com 5252 Acre.exe.com 5352 22222.exe -
resource yara_rule behavioral8/files/0x000100000001ab81-170.dat upx behavioral8/files/0x000100000001ab81-169.dat upx behavioral8/files/0x000100000001abaa-300.dat upx behavioral8/files/0x000100000001abaa-297.dat upx -
resource yara_rule behavioral8/memory/4444-344-0x0000000000400000-0x000000000064F000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion a9gDqMHrxPYaWrUxMVsbW1V2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion a9gDqMHrxPYaWrUxMVsbW1V2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion UkmTPs0rFNG9FFsKCk78g0l2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion UkmTPs0rFNG9FFsKCk78g0l2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation sonia_5.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url Sensitive.exe.com File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url Acre.exe.com -
Loads dropped DLL 16 IoCs
pid Process 3364 setup_install.exe 3364 setup_install.exe 3364 setup_install.exe 3364 setup_install.exe 3364 setup_install.exe 500 sonia_2.exe 1040 rundll32.exe 4896 117D33zwMB8bPOfXegmrHx4m.exe 4896 117D33zwMB8bPOfXegmrHx4m.exe 4868 v5KhW_TcnpH5aYBa8g3Ln7GX.exe 4868 v5KhW_TcnpH5aYBa8g3Ln7GX.exe 5800 rundll32.exe 6124 rundll32.exe 6176 dcwjjwv 6556 dcwjjwv 7136 dcwjjwv -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral8/files/0x000100000001ab8d-286.dat themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA a9gDqMHrxPYaWrUxMVsbW1V2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA UkmTPs0rFNG9FFsKCk78g0l2.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA j56hAiNU2FEkLEohS7jxKWsK.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 18 ipinfo.io 19 ip-api.com 162 api.ipify.org 17 ipinfo.io -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent D45B7D20DAFB4D92 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 820 a9gDqMHrxPYaWrUxMVsbW1V2.exe 2436 UkmTPs0rFNG9FFsKCk78g0l2.exe -
Suspicious use of SetThreadContext 10 IoCs
description pid Process procid_target PID 1368 set thread context of 764 1368 svchost.exe 99 PID 4576 set thread context of 5096 4576 OLKbrowser.exe 111 PID 4780 set thread context of 4588 4780 GsKIbaZinERmqiQo2bbcT__z.exe 118 PID 2572 set thread context of 4896 2572 117D33zwMB8bPOfXegmrHx4m.exe 137 PID 4800 set thread context of 4920 4800 WerFault.exe 135 PID 4460 set thread context of 4816 4460 V2ZsHh5vdIchwQDjPx49zRCQ.exe 138 PID 4384 set thread context of 4764 4384 Conhost.exe 185 PID 5952 set thread context of 6212 5952 1234.exe 219 PID 4212 set thread context of 5180 4212 Sensitive.exe.com 225 PID 4984 set thread context of 4908 4984 Acre.exe.com 226 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe S7LnygKf1MypZwcoNyLV2HFd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg S7LnygKf1MypZwcoNyLV2HFd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg S7LnygKf1MypZwcoNyLV2HFd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat S7LnygKf1MypZwcoNyLV2HFd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe S7LnygKf1MypZwcoNyLV2HFd.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe S7LnygKf1MypZwcoNyLV2HFd.exe File created C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini S7LnygKf1MypZwcoNyLV2HFd.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\winnetdriv.exe setup 326.exe File opened for modification C:\Windows\winnetdriv.exe setup 326.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 420 2332 WerFault.exe 88 4064 416 WerFault.exe 115 4320 416 WerFault.exe 115 4800 416 WerFault.exe 115 4296 416 WerFault.exe 115 2132 416 WerFault.exe 115 4680 416 WerFault.exe 115 3696 416 WerFault.exe 115 5224 5080 WerFault.exe 127 5284 6124 WerFault.exe 189 -
Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI dcwjjwv -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 v5KhW_TcnpH5aYBa8g3Ln7GX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString v5KhW_TcnpH5aYBa8g3Ln7GX.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 117D33zwMB8bPOfXegmrHx4m.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 117D33zwMB8bPOfXegmrHx4m.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 PING.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString PING.EXE -
Delays execution with timeout.exe 2 IoCs
pid Process 5684 timeout.exe 5536 timeout.exe -
Kills process with taskkill 3 IoCs
pid Process 6060 taskkill.exe 4720 taskkill.exe 5056 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2532 = "Chatham Islands Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-152 = "Central America Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-731 = "Fiji Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-751 = "Tonga Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-892 = "Morocco Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2792 = "Novosibirsk Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-651 = "AUS Central Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-341 = "Egypt Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time" WaPTXmcUMgAUnP4pSXYpr6ff.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CTLs MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT} svchost.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/ MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 1d24df8b702cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34AB MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 1d24df8b702cd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\DatabaseComplete = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch\OpenSearchDescriptionData = baffc49ee383374a8abf67e99635ea1e0100000053b06a1abe27334898108231552c52911f000000260000007700770077002e0067006f006f0067006c0065002e0063006f006d0000001f0000007e000000680074007400700073003a002f002f007700770077002e0067006f006f0067006c0065002e0063006f006d002f0073006500610072006300680064006f006d00610069006e0063006800650063006b003f0066006f0072006d00610074003d006f00700065006e0073006500610072006300680000001f0000002400000047006f006f0067006c00650020007a006f0065006b0065006e0000001f0020310a000000000000000000 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "395205405" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\Certificates MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe -
Runs .reg file with regedit 2 IoCs
pid Process 5524 regedit.exe 4556 regedit.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5720 PING.EXE 4764 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 500 sonia_2.exe 500 sonia_2.exe 1040 rundll32.exe 1040 rundll32.exe 1368 svchost.exe 1368 svchost.exe 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found 3032 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3032 Process not Found -
Suspicious behavior: MapViewOfSection 8 IoCs
pid Process 500 sonia_2.exe 4924 MicrosoftEdgeCP.exe 4924 MicrosoftEdgeCP.exe 6176 dcwjjwv 4212 Sensitive.exe.com 4984 Acre.exe.com 6556 dcwjjwv 7136 dcwjjwv -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4056 sonia_4.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1368 svchost.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeDebugPrivilege 1040 rundll32.exe Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeCreateTokenPrivilege 5056 taskkill.exe Token: SeAssignPrimaryTokenPrivilege 5056 taskkill.exe Token: SeLockMemoryPrivilege 5056 taskkill.exe Token: SeIncreaseQuotaPrivilege 5056 taskkill.exe Token: SeMachineAccountPrivilege 5056 taskkill.exe Token: SeTcbPrivilege 5056 taskkill.exe Token: SeSecurityPrivilege 5056 taskkill.exe Token: SeTakeOwnershipPrivilege 5056 taskkill.exe Token: SeLoadDriverPrivilege 5056 taskkill.exe Token: SeSystemProfilePrivilege 5056 taskkill.exe Token: SeSystemtimePrivilege 5056 taskkill.exe Token: SeProfSingleProcessPrivilege 5056 taskkill.exe Token: SeIncBasePriorityPrivilege 5056 taskkill.exe Token: SeCreatePagefilePrivilege 5056 taskkill.exe Token: SeCreatePermanentPrivilege 5056 taskkill.exe Token: SeBackupPrivilege 5056 taskkill.exe Token: SeRestorePrivilege 5056 taskkill.exe Token: SeShutdownPrivilege 5056 taskkill.exe Token: SeDebugPrivilege 5056 taskkill.exe Token: SeAuditPrivilege 5056 taskkill.exe Token: SeSystemEnvironmentPrivilege 5056 taskkill.exe Token: SeChangeNotifyPrivilege 5056 taskkill.exe Token: SeRemoteShutdownPrivilege 5056 taskkill.exe Token: SeUndockPrivilege 5056 taskkill.exe Token: SeSyncAgentPrivilege 5056 taskkill.exe Token: SeEnableDelegationPrivilege 5056 taskkill.exe Token: SeManageVolumePrivilege 5056 taskkill.exe Token: SeImpersonatePrivilege 5056 taskkill.exe Token: SeCreateGlobalPrivilege 5056 taskkill.exe Token: 31 5056 taskkill.exe Token: 32 5056 taskkill.exe Token: 33 5056 taskkill.exe Token: 34 5056 taskkill.exe Token: 35 5056 taskkill.exe Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found Token: SeCreatePagefilePrivilege 3032 Process not Found Token: SeShutdownPrivilege 3032 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3032 Process not Found 3032 Process not Found -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3032 Process not Found 5980 MicrosoftEdge.exe 4924 MicrosoftEdgeCP.exe 4924 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3032 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 416 wrote to memory of 3776 416 8 (16).exe 75 PID 416 wrote to memory of 3776 416 8 (16).exe 75 PID 416 wrote to memory of 3776 416 8 (16).exe 75 PID 3776 wrote to memory of 3364 3776 setup_installer.exe 76 PID 3776 wrote to memory of 3364 3776 setup_installer.exe 76 PID 3776 wrote to memory of 3364 3776 setup_installer.exe 76 PID 3364 wrote to memory of 2268 3364 setup_install.exe 79 PID 3364 wrote to memory of 2268 3364 setup_install.exe 79 PID 3364 wrote to memory of 2268 3364 setup_install.exe 79 PID 3364 wrote to memory of 2132 3364 setup_install.exe 80 PID 3364 wrote to memory of 2132 3364 setup_install.exe 80 PID 3364 wrote to memory of 2132 3364 setup_install.exe 80 PID 3364 wrote to memory of 984 3364 setup_install.exe 91 PID 3364 wrote to memory of 984 3364 setup_install.exe 91 PID 3364 wrote to memory of 984 3364 setup_install.exe 91 PID 3364 wrote to memory of 1828 3364 setup_install.exe 90 PID 3364 wrote to memory of 1828 3364 setup_install.exe 90 PID 3364 wrote to memory of 1828 3364 setup_install.exe 90 PID 3364 wrote to memory of 3492 3364 setup_install.exe 81 PID 3364 wrote to memory of 3492 3364 setup_install.exe 81 PID 3364 wrote to memory of 3492 3364 setup_install.exe 81 PID 3364 wrote to memory of 3532 3364 setup_install.exe 83 PID 3364 wrote to memory of 3532 3364 setup_install.exe 83 PID 3364 wrote to memory of 3532 3364 setup_install.exe 83 PID 3364 wrote to memory of 3480 3364 setup_install.exe 82 PID 3364 wrote to memory of 3480 3364 setup_install.exe 82 PID 3364 wrote to memory of 3480 3364 setup_install.exe 82 PID 3492 wrote to memory of 1048 3492 cmd.exe 84 PID 3492 wrote to memory of 1048 3492 cmd.exe 84 PID 3492 wrote to memory of 1048 3492 cmd.exe 84 PID 2132 wrote to memory of 500 2132 cmd.exe 85 PID 2132 wrote to memory of 500 2132 cmd.exe 85 PID 2132 wrote to memory of 500 2132 cmd.exe 85 PID 2268 wrote to memory of 3924 2268 cmd.exe 89 PID 2268 wrote to memory of 3924 2268 cmd.exe 89 PID 2268 wrote to memory of 3924 2268 cmd.exe 89 PID 984 wrote to memory of 2332 984 cmd.exe 88 PID 984 wrote to memory of 2332 984 cmd.exe 88 PID 984 wrote to memory of 2332 984 cmd.exe 88 PID 1828 wrote to memory of 4056 1828 cmd.exe 86 PID 1828 wrote to memory of 4056 1828 cmd.exe 86 PID 3532 wrote to memory of 3916 3532 cmd.exe 87 PID 3532 wrote to memory of 3916 3532 cmd.exe 87 PID 3532 wrote to memory of 3916 3532 cmd.exe 87 PID 3924 wrote to memory of 2880 3924 sonia_1.exe 92 PID 3924 wrote to memory of 2880 3924 sonia_1.exe 92 PID 3924 wrote to memory of 2880 3924 sonia_1.exe 92 PID 3916 wrote to memory of 2936 3916 sonia_6.exe 94 PID 3916 wrote to memory of 2936 3916 sonia_6.exe 94 PID 3916 wrote to memory of 2936 3916 sonia_6.exe 94 PID 4056 wrote to memory of 948 4056 sonia_4.exe 96 PID 4056 wrote to memory of 948 4056 sonia_4.exe 96 PID 4056 wrote to memory of 948 4056 sonia_4.exe 96 PID 3256 wrote to memory of 1040 3256 rUNdlL32.eXe 97 PID 3256 wrote to memory of 1040 3256 rUNdlL32.eXe 97 PID 3256 wrote to memory of 1040 3256 rUNdlL32.eXe 97 PID 1040 wrote to memory of 1368 1040 rundll32.exe 69 PID 1040 wrote to memory of 2804 1040 rundll32.exe 12 PID 1368 wrote to memory of 764 1368 svchost.exe 99 PID 1368 wrote to memory of 764 1368 svchost.exe 99 PID 1368 wrote to memory of 764 1368 svchost.exe 99 PID 1040 wrote to memory of 352 1040 rundll32.exe 52 PID 1040 wrote to memory of 2484 1040 rundll32.exe 19 PID 1040 wrote to memory of 2472 1040 rundll32.exe 20
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2660
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2804
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2636
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2484
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2472
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1820
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1416
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1300
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1220
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1084
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:356 -
C:\Users\Admin\AppData\Roaming\dcwjjwvC:\Users\Admin\AppData\Roaming\dcwjjwv2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6176
-
-
C:\Users\Admin\AppData\Roaming\dcwjjwvC:\Users\Admin\AppData\Roaming\dcwjjwv2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6556
-
-
C:\Users\Admin\AppData\Roaming\dcwjjwvC:\Users\Admin\AppData\Roaming\dcwjjwv2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:7136
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:352
-
C:\Users\Admin\AppData\Local\Temp\8 (16).exe"C:\Users\Admin\AppData\Local\Temp\8 (16).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3776 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_1.exe" -a6⤵
- Executes dropped EXE
PID:2880
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:500
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1048 -
C:\Users\Admin\Documents\wnRPIY7Hs5vIygbeuxI2wM0_.exe"C:\Users\Admin\Documents\wnRPIY7Hs5vIygbeuxI2wM0_.exe"6⤵
- Executes dropped EXE
PID:4792
-
-
C:\Users\Admin\Documents\GsKIbaZinERmqiQo2bbcT__z.exe"C:\Users\Admin\Documents\GsKIbaZinERmqiQo2bbcT__z.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4780 -
C:\Users\Admin\Documents\GsKIbaZinERmqiQo2bbcT__z.exeC:\Users\Admin\Documents\GsKIbaZinERmqiQo2bbcT__z.exe7⤵
- Executes dropped EXE
PID:4588
-
-
-
C:\Users\Admin\Documents\A6QLNHgtE7z0Hz63SvwAEmcF.exe"C:\Users\Admin\Documents\A6QLNHgtE7z0Hz63SvwAEmcF.exe"6⤵
- Executes dropped EXE
PID:4860 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵PID:192
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:4960
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵PID:5928
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comAcre.exe.com k9⤵
- Executes dropped EXE
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k10⤵
- Executes dropped EXE
PID:3900 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k11⤵
- Executes dropped EXE
PID:5308 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k12⤵PID:5852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k13⤵
- Executes dropped EXE
PID:6140 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k14⤵
- Executes dropped EXE
PID:5252 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k15⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe16⤵PID:4908
-
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:5720
-
-
-
-
-
C:\Users\Admin\Documents\lEsjNHNB7SaR77gHJyF_aarp.exe"C:\Users\Admin\Documents\lEsjNHNB7SaR77gHJyF_aarp.exe"6⤵
- Executes dropped EXE
PID:4952 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5992
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5892
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5352
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:204
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:4288
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6020
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:6960
-
-
-
C:\Users\Admin\Documents\S7LnygKf1MypZwcoNyLV2HFd.exe"C:\Users\Admin\Documents\S7LnygKf1MypZwcoNyLV2HFd.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5004 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵PID:4560
-
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2LBCU68⤵PID:4192
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg8⤵
- Runs .reg file with regedit
PID:5524
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg8⤵
- Runs .reg file with regedit
PID:4556
-
-
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵
- Executes dropped EXE
PID:1428
-
-
-
C:\Users\Admin\Documents\a9gDqMHrxPYaWrUxMVsbW1V2.exe"C:\Users\Admin\Documents\a9gDqMHrxPYaWrUxMVsbW1V2.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:820 -
C:\Users\Admin\AppData\Roaming\1234.exeC:\Users\Admin\AppData\Roaming\1234.exe 12347⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5952 -
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:6212
-
-
-
-
C:\Users\Admin\Documents\rtVrcXI5f48sXS0LBmSDxTjf.exe"C:\Users\Admin\Documents\rtVrcXI5f48sXS0LBmSDxTjf.exe"6⤵PID:5056
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:5840
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:6060
-
-
-
-
C:\Users\Admin\Documents\1Pv6W4BRy4b0QGmG6QlWYpm1.exe"C:\Users\Admin\Documents\1Pv6W4BRy4b0QGmG6QlWYpm1.exe"6⤵
- Executes dropped EXE
PID:4224 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm7⤵PID:2568
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV18⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4384
-
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:4812
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm9⤵PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comSensitive.exe.com p9⤵
- Executes dropped EXE
PID:5908 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p10⤵
- Executes dropped EXE
PID:5424 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p11⤵
- Executes dropped EXE
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p12⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4212 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe13⤵PID:5180
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Executes dropped EXE
- Checks processor information in registry
- Runs ping.exe
PID:4764
-
-
-
-
-
C:\Users\Admin\Documents\117D33zwMB8bPOfXegmrHx4m.exe"C:\Users\Admin\Documents\117D33zwMB8bPOfXegmrHx4m.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2572 -
C:\Users\Admin\Documents\117D33zwMB8bPOfXegmrHx4m.exeC:\Users\Admin\Documents\117D33zwMB8bPOfXegmrHx4m.exe7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4896 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 117D33zwMB8bPOfXegmrHx4m.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\117D33zwMB8bPOfXegmrHx4m.exe" & del C:\ProgramData\*.dll & exit8⤵PID:5392
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 117D33zwMB8bPOfXegmrHx4m.exe /f9⤵
- Kills process with taskkill
PID:4720
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 69⤵
- Delays execution with timeout.exe
PID:5684
-
-
-
-
-
C:\Users\Admin\Documents\WaPTXmcUMgAUnP4pSXYpr6ff.exe"C:\Users\Admin\Documents\WaPTXmcUMgAUnP4pSXYpr6ff.exe"6⤵
- Executes dropped EXE
PID:4732 -
C:\Users\Admin\Documents\WaPTXmcUMgAUnP4pSXYpr6ff.exe"C:\Users\Admin\Documents\WaPTXmcUMgAUnP4pSXYpr6ff.exe"7⤵
- Modifies data under HKEY_USERS
PID:5708
-
-
-
C:\Users\Admin\Documents\v5KhW_TcnpH5aYBa8g3Ln7GX.exe"C:\Users\Admin\Documents\v5KhW_TcnpH5aYBa8g3Ln7GX.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4868 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im v5KhW_TcnpH5aYBa8g3Ln7GX.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\v5KhW_TcnpH5aYBa8g3Ln7GX.exe" & del C:\ProgramData\*.dll & exit7⤵PID:3180
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im v5KhW_TcnpH5aYBa8g3Ln7GX.exe /f8⤵
- Executes dropped EXE
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:5536
-
-
-
-
C:\Users\Admin\Documents\2qODuGtpFMRxbifv7pBny02B.exe"C:\Users\Admin\Documents\2qODuGtpFMRxbifv7pBny02B.exe"6⤵PID:4800
-
C:\Users\Admin\Documents\2qODuGtpFMRxbifv7pBny02B.exeC:\Users\Admin\Documents\2qODuGtpFMRxbifv7pBny02B.exe7⤵
- Executes dropped EXE
PID:4920
-
-
-
C:\Users\Admin\Documents\V2ZsHh5vdIchwQDjPx49zRCQ.exe"C:\Users\Admin\Documents\V2ZsHh5vdIchwQDjPx49zRCQ.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4460 -
C:\Users\Admin\Documents\V2ZsHh5vdIchwQDjPx49zRCQ.exeC:\Users\Admin\Documents\V2ZsHh5vdIchwQDjPx49zRCQ.exe7⤵
- Executes dropped EXE
PID:4816
-
-
-
C:\Users\Admin\Documents\UkmTPs0rFNG9FFsKCk78g0l2.exe"C:\Users\Admin\Documents\UkmTPs0rFNG9FFsKCk78g0l2.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2436
-
-
C:\Users\Admin\Documents\j56hAiNU2FEkLEohS7jxKWsK.exe"C:\Users\Admin\Documents\j56hAiNU2FEkLEohS7jxKWsK.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4444
-
-
C:\Users\Admin\Documents\GDPk6sdtxujK3Ve4knzl7zI_.exe"C:\Users\Admin\Documents\GDPk6sdtxujK3Ve4knzl7zI_.exe"6⤵PID:4384
-
C:\Users\Admin\Documents\GDPk6sdtxujK3Ve4knzl7zI_.exe"C:\Users\Admin\Documents\GDPk6sdtxujK3Ve4knzl7zI_.exe"7⤵PID:4764
-
-
-
C:\Users\Admin\Documents\ISRaOOYqZQFkJ7f3r0UDpoqM.exe"C:\Users\Admin\Documents\ISRaOOYqZQFkJ7f3r0UDpoqM.exe"6⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\Documents\ISRaOOYqZQFkJ7f3r0UDpoqM.exe"C:\Users\Admin\Documents\ISRaOOYqZQFkJ7f3r0UDpoqM.exe" -a7⤵
- Executes dropped EXE
PID:5576
-
-
-
C:\Users\Admin\Documents\WwFXdImRtQ9aqwATUUB7nRm1.exe"C:\Users\Admin\Documents\WwFXdImRtQ9aqwATUUB7nRm1.exe"6⤵
- Executes dropped EXE
PID:4656 -
C:\Users\Admin\AppData\Roaming\3138486.exe"C:\Users\Admin\AppData\Roaming\3138486.exe"7⤵
- Executes dropped EXE
PID:6100
-
-
C:\Users\Admin\AppData\Roaming\7099489.exe"C:\Users\Admin\AppData\Roaming\7099489.exe"7⤵
- Executes dropped EXE
PID:5124
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵PID:3480
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3532 -
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:4164
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:2344
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:6956
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1828
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:984
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:764
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_4.exesonia_4.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"2⤵
- Executes dropped EXE
PID:948 -
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"3⤵
- Executes dropped EXE
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:4384
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵
- Executes dropped EXE
PID:584
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:2276
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt4⤵PID:7096
-
-
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4576 -
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe4⤵
- Executes dropped EXE
PID:5096
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4708 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626805100 04⤵
- Executes dropped EXE
PID:4824
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"3⤵
- Executes dropped EXE
PID:416 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 7164⤵
- Program crash
PID:4064
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 9524⤵
- Program crash
PID:4320
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 9324⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Program crash
PID:4800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 8244⤵
- Program crash
PID:4296
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 9524⤵
- Program crash
PID:2132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 9484⤵
- Program crash
PID:4680
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 416 -s 10564⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:3696
-
-
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"3⤵
- Executes dropped EXE
PID:4348 -
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a4⤵
- Executes dropped EXE
PID:5172
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"3⤵
- Executes dropped EXE
PID:5080 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5080 -s 10004⤵
- Program crash
PID:5224
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS0CE34325\sonia_3.exesonia_3.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2332 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2332 -s 9042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:420
-
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1040
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:3256
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:5196
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5776 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5800
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:6040 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:6124 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6124 -s 6203⤵
- Program crash
PID:5284
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5980
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5216
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4924
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
PID:5852
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6484
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6704
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6280
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6588
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
1Web Service
1