Overview
overview
10Static
static
8 (1).exe
windows10_x64
108 (10).exe
windows10_x64
108 (11).exe
windows10_x64
108 (12).exe
windows10_x64
108 (13).exe
windows10_x64
108 (14).exe
windows10_x64
108 (15).exe
windows10_x64
108 (16).exe
windows10_x64
108 (17).exe
windows10_x64
108 (18).exe
windows10_x64
108 (19).exe
windows10_x64
108 (2).exe
windows10_x64
108 (20).exe
windows10_x64
108 (21).exe
windows10_x64
108 (22).exe
windows10_x64
108 (23).exe
windows10_x64
108 (24).exe
windows10_x64
8 (25).exe
windows10_x64
108 (26).exe
windows10_x64
108 (27).exe
windows10_x64
108 (28).exe
windows10_x64
108 (29).exe
windows10_x64
108 (3).exe
windows10_x64
108 (30).exe
windows10_x64
108 (31).exe
windows10_x64
108 (4).exe
windows10_x64
108 (5).exe
windows10_x64
108 (6).exe
windows10_x64
108 (7).exe
windows10_x64
108 (8).exe
windows10_x64
108 (9).exe
windows10_x64
108.exe
windows10_x64
10Resubmissions
13/08/2021, 10:16
210813-wpta271jdx 1008/08/2021, 23:00
210808-fgs5g9pxfs 1007/08/2021, 23:12
210807-g2jw1lmd4a 1007/08/2021, 16:10
210807-51nhct4kfx 1006/08/2021, 23:43
210806-gc2271nxwj 1006/08/2021, 06:00
210806-f443x39x8a 1005/08/2021, 17:08
210805-97y6banvvx 1004/08/2021, 17:25
210804-hkxx2ntr8x 1004/08/2021, 12:12
210804-rjbg4b4y7n 1003/08/2021, 17:12
210803-r2h7ytjwqj 10Analysis
-
max time kernel
1801s -
max time network
1812s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
08/08/2021, 23:00
Static task
static1
Behavioral task
behavioral1
Sample
8 (1).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8 (10).exe
Resource
win10v20210408
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
8 (11).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
8 (12).exe
Resource
win10v20210408
redlinesmokeloadersocelarsvidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
8 (13).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
8 (14).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
8 (15).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwarespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
8 (16).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
8 (17).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
8 (18).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistenceransomwarespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
8 (19).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
8 (2).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
8 (20).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
8 (21).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
8 (22).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
8 (23).exe
Resource
win10v20210408
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
8 (24).exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
8 (25).exe
Resource
win10v20210408
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
8 (26).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
8 (27).exe
Resource
win10v20210408
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
8 (28).exe
Resource
win10v20210410
gluptebametasploitredlinesmokeloadersocelarsvidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral22
Sample
8 (29).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildaspackv2backdoorinfostealerpersistencestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral23
Sample
8 (3).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral24
Sample
8 (30).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral25
Sample
8 (31).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral26
Sample
8 (4).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistenceransomwarespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral27
Sample
8 (5).exe
Resource
win10v20210408
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral28
Sample
8 (6).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral29
Sample
8 (7).exe
Resource
win10v20210410
redlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoveryevasioninfostealerpersistencespywarestealersuricatatrojanupxvmprotect
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral30
Sample
8 (8).exe
Resource
win10v20210408
gluptebametasploitredlinesmokeloadervidar56k_test933dibildgrekhaspackv2backdoordiscoverydropperevasioninfostealerloaderpersistencespywarestealersuricatatrojanupx
windows10_x64
0 signatures
0 seconds
General
-
Target
8 (7).exe
-
Size
3.0MB
-
MD5
bb072cad921aa5ce8b97706ce01bc570
-
SHA1
18bf034906c1341b7817e7361ad27a4425d820bd
-
SHA256
817a50d00909383bbef41e6f4e61b527d55f0873bcf745b29dbba75f52fe2e97
-
SHA512
d40e5f77d882ed29bd9de5a6848072e2f81cd02176955e2b1a4aedcdf4eb687d77bebe33cef0c7d702bc828181755f86e2564523d476adbb785f396a5ce1d474
Malware Config
Extracted
Family
vidar
Version
39.6
Botnet
933
C2
https://sslamlssa1.tumblr.com/
Attributes
-
profile_id
933
Extracted
Family
smokeloader
Version
2020
C2
http://conceitosseg.com/upload/
http://integrasidata.com/upload/
http://ozentekstil.com/upload/
http://finbelportal.com/upload/
http://telanganadigital.com/upload/
http://aucmoney.com/upload/
http://thegymmum.com/upload/
http://atvcampingtrips.com/upload/
http://kuapakualaman.com/upload/
http://renatazarazua.com/upload/
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Extracted
Family
redline
Botnet
56k_TEST
C2
45.14.49.117:14251
Extracted
Family
redline
Botnet
dibild
C2
135.148.139.222:33569
Extracted
Family
redline
Botnet
grekh
C2
5.8.248.83:61808
Signatures
-
Process spawned unexpected child process 4 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 184 rUNdlL32.eXe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6072 184 rundll32.exe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5144 184 rUNdlL32.eXe 96 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5532 184 rundll32.exe 96 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 9 IoCs
resource yara_rule behavioral29/files/0x000200000001561d-230.dat family_redline behavioral29/files/0x000200000001561d-246.dat family_redline behavioral29/files/0x000100000001ab9c-278.dat family_redline behavioral29/memory/4332-282-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral29/files/0x000100000001ab9c-299.dat family_redline behavioral29/files/0x000100000001abaa-293.dat family_redline behavioral29/memory/4332-285-0x0000000000418E52-mapping.dmp family_redline behavioral29/memory/4492-320-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral29/memory/4492-325-0x0000000000418E3E-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 4348 created 3172 4348 WerFault.exe 89 PID 5604 created 4508 5604 WerFault.exe 117 PID 6104 created 5032 6104 WerFault.exe 104 -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 6248 created 4996 6248 svchost.exe 118 -
suricata: ET MALWARE GCleaner Downloader Activity M1
suricata: ET MALWARE GCleaner Downloader Activity M1
-
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
suricata: ET MALWARE Generic Password Stealer User Agent Detected (RookIE)
-
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
-
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
suricata: ET MALWARE Possible Dridex Download URI Struct with no referer
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
suricata: ET MALWARE Win32/Adware.Agent.NSU CnC Activity M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Vidar Stealer 1 IoCs
resource yara_rule behavioral29/memory/3172-183-0x0000000000400000-0x00000000008F2000-memory.dmp family_vidar -
resource yara_rule behavioral29/files/0x000100000001ab7f-118.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7f-119.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7a-123.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7b-125.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7d-129.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7d-127.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7a-124.dat aspack_v212_v242 behavioral29/files/0x000100000001ab7b-122.dat aspack_v212_v242 -
Blocklisted process makes network request 52 IoCs
flow pid Process 235 6180 MsiExec.exe 237 6180 MsiExec.exe 239 6180 MsiExec.exe 241 6180 MsiExec.exe 244 6180 MsiExec.exe 245 6180 MsiExec.exe 246 6180 MsiExec.exe 249 6180 MsiExec.exe 252 6180 MsiExec.exe 254 6180 MsiExec.exe 256 6180 MsiExec.exe 257 6180 MsiExec.exe 258 6180 MsiExec.exe 260 6180 MsiExec.exe 262 6180 MsiExec.exe 264 6180 MsiExec.exe 265 6180 MsiExec.exe 266 6180 MsiExec.exe 267 6180 MsiExec.exe 268 6180 MsiExec.exe 269 6180 MsiExec.exe 270 6180 MsiExec.exe 271 6180 MsiExec.exe 272 6180 MsiExec.exe 273 6180 MsiExec.exe 274 6180 MsiExec.exe 275 6180 MsiExec.exe 276 6180 MsiExec.exe 277 6180 MsiExec.exe 281 6180 MsiExec.exe 282 6180 MsiExec.exe 283 6180 MsiExec.exe 284 6180 MsiExec.exe 285 6180 MsiExec.exe 286 6180 MsiExec.exe 287 6180 MsiExec.exe 289 6180 MsiExec.exe 290 6180 MsiExec.exe 292 6180 MsiExec.exe 293 6180 MsiExec.exe 294 6180 MsiExec.exe 295 6180 MsiExec.exe 296 6180 MsiExec.exe 297 6180 MsiExec.exe 299 6180 MsiExec.exe 300 6180 MsiExec.exe 301 6180 MsiExec.exe 302 6180 MsiExec.exe 376 7084 MsiExec.exe 379 7084 MsiExec.exe 380 7084 MsiExec.exe 381 7084 MsiExec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts Daldoula.exe -
Executes dropped EXE 64 IoCs
pid Process 2020 setup_installer.exe 2760 setup_install.exe 4080 sonia_2.exe 1308 sonia_1.exe 3948 sonia_5.exe 3172 sonia_3.exe 1148 sonia_4.exe 632 sonia_6.exe 3896 sonia_1.exe 4944 9xDsKzy1IAdDvUqyTYaPEu6p.exe 4956 BKZGrSUdfW4vPgsbMhjHT57N.exe 4976 mDTtXgOrLcb2Bt9befNUToLr.exe 5032 HK7IRkfm21iBjYJmT2wvPOFr.exe 5084 WerFault.exe 1468 jfiag3g_gg.exe 4548 3ZY093ZJBSUgDBZdHEcgChHk.exe 4340 WerFault.exe 4280 XpQYqP0zpTKhNKedwKvFtfVw.exe 4228 eFUQhtnuFewP5MM0FU30eR02.exe 4728 fNdJ7ZxVTZVxMEEZEPxpgF8k.exe 4332 BKZGrSUdfW4vPgsbMhjHT57N.exe 3464 K7lmuWcia7qPxK7XPMIPIoZy.exe 1012 hx42SOBt3i_1llFwed3Lvhkh.exe 4996 TPYSTmlSnmWbscmgp1GW1cap.exe 4508 NR9ftMafc1hg6nygFAlyWuNd.exe 3832 hljnzfj9D7xi6JOhODl0jNnt.exe 4492 mDTtXgOrLcb2Bt9befNUToLr.exe 1756 hx42SOBt3i_1llFwed3Lvhkh.tmp 4524 eFUQhtnuFewP5MM0FU30eR02.exe 3476 customer3.exe 5056 md8_8eus.exe 2508 jfiag3g_gg.exe 2768 jooyu.exe 2576 7527634.exe 4984 7527634.exe 4092 4518041.exe 4388 jfiag3g_gg.exe 2404 4239109.exe 2972 11111.exe 5276 Setup.exe 5492 GameBox32Bit.exe 5500 11111.exe 5520 11111.exe 5540 BotCheck.exe 5592 GameBox.exe 5624 note8876.exe 5656 11111.exe 5688 GameBoxWin32.exe 5732 GameBoxWin64.exe 5808 GameBoxWin32.tmp 5924 jfiag3g_gg.exe 4788 BotCheck.exe 4896 11111.exe 4904 11111.exe 5376 11111.exe 5696 3925878.exe 5784 7328391.exe 6112 4624145.exe 5960 3481378.exe 5992 WinHoster.exe 5700 22222.exe 5080 22222.exe 5148 22222.exe 5300 22222.exe -
resource yara_rule behavioral29/files/0x000100000001abac-254.dat upx behavioral29/files/0x000100000001abac-255.dat upx -
resource yara_rule behavioral29/memory/5056-376-0x0000000000400000-0x000000000067D000-memory.dmp vmprotect -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation sonia_5.exe Key value queried \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Control Panel\International\Geo\Nation Qyshihahadae.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fastsystem2021.exe customer3.exe -
Loads dropped DLL 64 IoCs
pid Process 2760 setup_install.exe 2760 setup_install.exe 2760 setup_install.exe 2760 setup_install.exe 2760 setup_install.exe 4080 sonia_2.exe 4144 rundll32.exe 1756 hx42SOBt3i_1llFwed3Lvhkh.tmp 1756 hx42SOBt3i_1llFwed3Lvhkh.tmp 5732 GameBoxWin64.exe 5732 GameBoxWin64.exe 5808 GameBoxWin32.tmp 6100 rundll32.exe 5088 rundll32.exe 5732 GameBoxWin64.exe 5292 MsiExec.exe 5292 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 6180 MsiExec.exe 5732 GameBoxWin64.exe 6180 MsiExec.exe 6180 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 7012 MsiExec.exe 6180 MsiExec.exe 3152 installer.exe 3152 installer.exe 3152 installer.exe 684 MsiExec.exe 684 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 7084 MsiExec.exe 3152 installer.exe 7084 MsiExec.exe 7084 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 6316 MsiExec.exe 7084 MsiExec.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WinHost = "C:\\Users\\Admin\\AppData\\Roaming\\WinHost\\WinHoster.exe" 7328391.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\AW Manager\\Cezhaqudiwo.exe\"" Daldoula.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\haleng = "C:\\Users\\Admin\\AppData\\Local\\Temp\\haleng.exe" sonia_6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA md8_8eus.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA note8876.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\V: GameBoxWin64.exe File opened (read-only) \??\Y: GameBoxWin64.exe File opened (read-only) \??\Z: GameBoxWin64.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\X: GameBoxWin64.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\B: GameBoxWin64.exe File opened (read-only) \??\I: GameBoxWin64.exe File opened (read-only) \??\O: GameBoxWin64.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\M: GameBoxWin64.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\N: GameBoxWin64.exe File opened (read-only) \??\U: GameBoxWin64.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\G: GameBoxWin64.exe File opened (read-only) \??\J: GameBoxWin64.exe File opened (read-only) \??\L: GameBoxWin64.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\S: GameBoxWin64.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\E: GameBoxWin64.exe File opened (read-only) \??\W: GameBoxWin64.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\P: GameBoxWin64.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\F: GameBoxWin64.exe File opened (read-only) \??\K: GameBoxWin64.exe File opened (read-only) \??\Q: GameBoxWin64.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\A: GameBoxWin64.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 ipinfo.io 11 ipinfo.io 13 ip-api.com 128 ipinfo.io 132 ipinfo.io 149 ip-api.com 339 ip-api.com -
Drops file in System32 directory 11 IoCs
description ioc Process File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #1 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedUpdater svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #2 svchost.exe File opened for modification C:\Windows\System32\Tasks\Firefox Default Browser Agent 9F035536D9B98FBC svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #3 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #4 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #5 svchost.exe File opened for modification C:\Windows\System32\Tasks\AdvancedWindowsManager #6 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\644B8874112055B5E195ECB0E8F243A4 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\644B8874112055B5E195ECB0E8F243A4 svchost.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2192 set thread context of 4220 2192 svchost.exe 99 PID 4956 set thread context of 4332 4956 BKZGrSUdfW4vPgsbMhjHT57N.exe 113 PID 2192 set thread context of 3868 2192 svchost.exe 127 PID 4976 set thread context of 4492 4976 mDTtXgOrLcb2Bt9befNUToLr.exe 124 -
Drops file in Program Files directory 40 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d note8876.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.ini msiexec.exe File created C:\Program Files\MSBuild\PGMIWNEXSM\ultramediaburner.exe Daldoula.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\customer3.exe hljnzfj9D7xi6JOhODl0jNnt.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File created C:\Program Files (x86)\AW Manager\Cezhaqudiwo.exe Daldoula.exe File created C:\Program Files (x86)\AW Manager\Cezhaqudiwo.exe.config Daldoula.exe File created C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.ini Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File created C:\Program Files\MSBuild\PGMIWNEXSM\ultramediaburner.exe.config Daldoula.exe File created C:\Program Files (x86)\UltraMediaBurner\is-IR1K8.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe Setup.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\jooyu.exe hljnzfj9D7xi6JOhODl0jNnt.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d md8_8eus.exe File created C:\Program Files (x86)\Company\NewProduct\tmp.edb md8_8eus.exe File created C:\Program Files (x86)\GameBox INC\GameBox\d note8876.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d.INTEG.RAW note8876.exe File created C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe hljnzfj9D7xi6JOhODl0jNnt.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\unins000.dat ultramediaburner.tmp File created C:\Program Files (x86)\AW Manager\Windows Manager\Uninstall.lnk msiexec.exe File created C:\Program Files (x86)\UltraMediaBurner\is-JHNIG.tmp ultramediaburner.tmp File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini hljnzfj9D7xi6JOhODl0jNnt.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\Uninstall.exe Setup.exe File created C:\Program Files (x86)\Company\NewProduct\d.jfm md8_8eus.exe File created C:\Program Files (x86)\GameBox INC\GameBox\tmp.edb note8876.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\Windows Updater.exe msiexec.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\Privacy.url msiexec.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe hljnzfj9D7xi6JOhODl0jNnt.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe Setup.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\d.jfm note8876.exe File opened for modification C:\Program Files (x86)\AW Manager\Windows Manager\EULA.url msiexec.exe File opened for modification C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe Setup.exe File created C:\Program Files (x86)\GameBox INC\GameBox\d.jfm note8876.exe File created C:\Program Files (x86)\AW Manager\Windows Manager\AdvancedWindowsManager.exe msiexec.exe File opened for modification C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe ultramediaburner.tmp File opened for modification C:\Program Files (x86)\Company\NewProduct\d.INTEG.RAW md8_8eus.exe -
Drops file in Windows directory 54 IoCs
description ioc Process File opened for modification C:\Windows\Installer\MSIA642.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A1D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8F73.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI535A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI58E1.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F20.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI59ED.tmp msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI8BF5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8FF2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI997C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAB78.tmp msiexec.exe File opened for modification C:\Windows\Installer\f758974.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI5533.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI8EE5.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4EC2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4FB0.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAA6C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4E92.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F61.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5788.tmp msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File opened for modification C:\Windows\Installer\MSI4A7A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI538A.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5B1A.tmp msiexec.exe File created C:\Windows\Installer\f758974.msi msiexec.exe File opened for modification C:\Windows\Installer\MSI8F24.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9841.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI98DF.tmp msiexec.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File opened for modification C:\Windows\Installer\MSI8E57.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA846.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File created C:\Windows\Installer\f758977.msi msiexec.exe File opened for modification C:\Windows\Installer\MSIAE29.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI53CA.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5467.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5A8C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI5544.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAA9C.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9C9B.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIAA1D.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9737.tmp msiexec.exe File created C:\Windows\Installer\SourceHash{C845414C-903C-4218-9DE7-132AB97FDF62} msiexec.exe File opened for modification C:\Windows\Installer\MSI9BEE.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI4F31.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI59BD.tmp msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\logo.exe msiexec.exe File opened for modification C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI8FD2.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSIA9DD.tmp msiexec.exe File created C:\Windows\Installer\{C845414C-903C-4218-9DE7-132AB97FDF62}\SystemFoldermsiexec.exe msiexec.exe File opened for modification C:\Windows\Installer\MSI595F.tmp msiexec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 13 IoCs
pid pid_target Process procid_target 2852 2760 WerFault.exe 76 4348 3172 WerFault.exe 89 1864 4492 WerFault.exe 124 4448 4508 WerFault.exe 117 4636 4508 WerFault.exe 117 4168 4508 WerFault.exe 117 4316 4508 WerFault.exe 117 5084 4508 WerFault.exe 117 4824 4508 WerFault.exe 117 4340 4508 WerFault.exe 117 5604 4508 WerFault.exe 117 5820 4508 WerFault.exe 117 6104 5032 WerFault.exe 104 -
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI sonia_2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI WerFault.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI grdajsb -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe -
Kills process with taskkill 2 IoCs
pid Process 6444 taskkill.exe 4920 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-462 = "Afghanistan Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2182 = "Astrakhan Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-601 = "Taipei Daylight Time" 11111.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-215 = "Pacific Standard Time (Mexico)" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-842 = "Argentina Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1722 = "Libya Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-201 = "US Mountain Daylight Time" 11111.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-365 = "Middle East Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2162 = "Altai Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1972 = "Belarus Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-431 = "Iran Daylight Time" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2511 = "Lord Howe Daylight Time" 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2632 = "Norfolk Standard Time" 11111.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs 11111.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1721 = "Libya Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1932 = "Russia TZ 11 Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-401 = "Arabic Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-231 = "Hawaiian Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1892 = "Russia TZ 3 Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" 11111.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-441 = "Arabian Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1471 = "Magadan Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-212 = "Pacific Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2371 = "Easter Island Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-512 = "Central Asia Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-352 = "FLE Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2062 = "North Korea Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2491 = "Aus Central W. Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2001 = "Cabo Verde Daylight Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-2772 = "Omsk Standard Time" 11111.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\17\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" 11111.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\FirstRecoveryTime = 301bd569d72dd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 0cf82660ab8cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = b0b5849dad8cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "268435456" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Net msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. = "1" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8a923bf0ab8cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\AuthorizedLUAApp = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "18" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\ProductName = "Windows Manager" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url4 = "https://login.live.com/" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\NextPromptBuild = "15063" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.acnav.online\ = "18" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Next Rating Prompt = 00f32d0fae98d701 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\Main MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{QJ2559JN-BF7A-LM2A-20M4-JBF9M43Q7G3S} svchost.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\acnav.online\ = "0" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\SignaturePolicy = 06000000 MicrosoftEdgeCP.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\Media\1 = ";" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\TypedUrlsComplete = "1" MicrosoftEdge.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\PackageCode = "6BBF4B2F4524B25478C17BFBEE2559F7" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 7c322260ab8cd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 81a3ea0ead8cd701 MicrosoftEdge.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{WW6060MI-ED3Y-MI7M-57W2-EJZ5M77G1X0K}\1 = "4592" svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C414548CC3098124D97E31A29BF7FD26\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\AW Manager\\Windows Manager 1.0.0\\install\\97FDF62\\" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory\NextBrowserDataLogTime = a002b894dc8cd701 MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\Certificates\83DA05A9886F7658BE = 03000000010000001400000083da05a9886f7658be73acf0a4930c0f99b92f011400000001000000140000003656896549cb5b9b2f3cac4216504d91b933d79104000000010000001000000062455357dd57cb80c32ab295743cccc00f00000001000000200000006811c6215f18c75fdbe32cf56bd66248562a7fa3ba459cfee338745061e583941900000001000000100000002d581a49c8eb5b3b3c6ef9bb65314d705c000000010000000400000000100000180000000100000010000000bb048f1838395f6fc3a1f3d2b7e976542000000001000000dc060000308206d8308204c0a003020102020a613fb718000000000004300d06092a864886f70d01010b0500308188310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e31323030060355040313294d6963726f736f667420526f6f7420436572746966696361746520417574686f726974792032303131301e170d3131313031383232353531395a170d3236313031383233303531395a307e310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e312830260603550403131f4d6963726f736f66742053656375726520536572766572204341203230313130820222300d06092a864886f70d01010105000382020f003082020a0282020100d00bc0a4a81981e236e5e2aae5f3b2155875beb4e549f1e084f9bb0d64ef85c18155b8f3e7f16d40553dce8b6ad18493f5757c5ba4d47410ca32f323d3aeeecf9e0458c2d947cbd17c004148711b01671718afc6fe73037ee4ef439cef01712a1f81264377985457739d552bf09e8e7d060eac1b54f326f7f82308228b9e061d3738fd72d2cae563c19a5a7db26db352a96ee9aeb5fc8b36f99efaf61c581b9756a511e5b752dbbbe9f054bfb4ff2c6cb85d26cea00ad7df93ed7fddacf12c731ad9193755badd22788ea1d49b09f807223171b094aee0b0e726445790819715ce61ec65e24bf185521632f8b578aa7ecd4dec8321a4a89bbe9a6a04e0a31ccd56186cfd6b2f423ee237f272abd07873727bdeec0058e52130a3083a99ef9fc3f77a169665b5c381aff4397049aff6a9f66a0038f9b40819e01a35a55676225f6af269ae3ead58464db854f68941441e72b1bc122753d2c1ffb2cd50981eb5f4bbb6c28239d9ac1bf23b27846ab0c6260bd73a10e7b3db7cd356ac534c0bfa3b313774d8592bf9007919067bfd1c1d42d4410d2f050ed56b4923ffcfcdf87a82cfda3c2ddfe8d8120418ba1e8877b8981f1007bbc8057e0b09bf6bdde34e5bb0f9c784a63bca4c9f5b6229f7c7a2a89588702ce5c13f3c52234f409ac33185832fbf29f11d508f219607ceeff280c2447d9b62ef2fc37789ab454d533e0279d30203010001a382014b30820147301006092b06010401823715010403020100301d0603551d0e041604143656896549cb5b9b2f3cac4216504d91b933d791301906092b0601040182371402040c1e0a00530075006200430041300b0603551d0f040403020186300f0603551d130101ff040530030101ff301f0603551d23041830168014722d3a02319043b914054ee1eaa7c731d1238934305a0603551d1f04533051304fa04da04b8649687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963526f6f436572417574323031315f323031315f30335f32322e63726c305e06082b0601050507010104523050304e06082b060105050730028642687474703a2f2f7777772e6d6963726f736f66742e636f6d2f706b692f63657274732f4d6963526f6f436572417574323031315f323031315f30335f32322e637274300d06092a864886f70d01010b0500038202010041c861c1f55b9e3e9131f1b0c6bf0901b49db69074d709dba62e0d9fc8e7763446af0760894c81b33cd5f4123575c273a5f54d848ccba45dafbf92f617085742957265057679adeed1bab82e54a35107ac68eb210ce32581c2cd2af2c3ffcfc2bd49189ac7f084c5f914bc6b95e596efb342d253d54aa012c4ae12765309560e9df7d3a6498850f28a2c9720a2be4e78ef0565b74ba11688de31c70842247ca47b9e9dbc60005e6297e393fca7fe5b7b25dfe4537f4bbee63ef0db0179421c6e856c7db64430fba5379293b2a5ee20ad3f53d5c9f4286b57c1f81d6ab7562ab627811ca62d9fe7f4d0318397a82ab6acbe1b41f5e4895f56fbda5ad35e7d5594107e5357f44a3d402ac8bd679f84e110eefdda6b158249fc461dff4506749c4214edc539d3b3cd0b832790435192f24482ae6e9a1517b219fac7456c98017bbf37a9b088a492bc3838e01de47c97981a2e5fef3865b7352fbd7f4f21fac48cd26f06f94935eadf200f25aaea60ab2c1f4b89fcb7fa5c54904b3ea2284f6ce45265c1fd901c8582886ee9a655dd21287945b014e50acce65fc4bbdb6134699fac2638f7c1294108152e4ca0f7f90c3ede5fab08092d83acac348362f4c949428925b56eb247c5b339a0b1201b2cb18e046fa530491cd046e9405bf4ad6ebadb824a87124a80094ddbdf76b9055b1be0bb20705f0025c7d30efa16ad7b229e7108 MicrosoftEdge.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.acnav.online MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total\ = "0" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersion = "1" MicrosoftEdge.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 sonia_3.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 11111.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 190000000100000010000000fd960962ac6938e0d4b0769aa1a64e26030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a1d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e76200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb65809000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c00b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f00720069007400790000000f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6502000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794 11111.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e sonia_3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 GameBoxWin64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A 11111.exe -
Script User-Agent 10 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 138 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 259 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 362 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 229 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 131 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 132 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 155 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 179 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 181 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 207 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 2852 WerFault.exe 4080 sonia_2.exe 4080 sonia_2.exe 4144 rundll32.exe 4144 rundll32.exe 2192 svchost.exe 2192 svchost.exe 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 4348 WerFault.exe 3120 Process not Found 3120 Process not Found 4348 WerFault.exe 4348 WerFault.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3120 Process not Found -
Suspicious behavior: MapViewOfSection 19 IoCs
pid Process 4080 sonia_2.exe 5084 WerFault.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 5144 grdajsb 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 5428 grdajsb 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe 6240 grdajsb 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeRestorePrivilege 2852 WerFault.exe Token: SeBackupPrivilege 2852 WerFault.exe Token: SeDebugPrivilege 1148 sonia_4.exe Token: SeDebugPrivilege 2852 WerFault.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 2192 svchost.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4144 rundll32.exe Token: SeDebugPrivilege 4348 WerFault.exe Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeDebugPrivilege 4548 3ZY093ZJBSUgDBZdHEcgChHk.exe Token: SeDebugPrivilege 2192 svchost.exe Token: SeDebugPrivilege 4976 mDTtXgOrLcb2Bt9befNUToLr.exe Token: SeDebugPrivilege 4944 9xDsKzy1IAdDvUqyTYaPEu6p.exe Token: SeDebugPrivilege 4340 WerFault.exe Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeDebugPrivilege 4332 BKZGrSUdfW4vPgsbMhjHT57N.exe Token: SeDebugPrivilege 4280 XpQYqP0zpTKhNKedwKvFtfVw.exe Token: SeDebugPrivilege 3464 K7lmuWcia7qPxK7XPMIPIoZy.exe Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeDebugPrivilege 4448 WerFault.exe Token: SeDebugPrivilege 4636 WerFault.exe Token: SeAuditPrivilege 2332 svchost.exe Token: SeDebugPrivilege 4168 WerFault.exe Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeDebugPrivilege 4316 WerFault.exe Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeShutdownPrivilege 3120 Process not Found Token: SeCreatePagefilePrivilege 3120 Process not Found Token: SeDebugPrivilege 5084 WerFault.exe Token: SeDebugPrivilege 4984 7527634.exe Token: SeDebugPrivilege 2576 7527634.exe Token: SeDebugPrivilege 4824 WerFault.exe -
Suspicious use of FindShellTrayWindow 10 IoCs
pid Process 1756 hx42SOBt3i_1llFwed3Lvhkh.tmp 3120 Process not Found 3120 Process not Found 3120 Process not Found 3120 Process not Found 5732 GameBoxWin64.exe 3120 Process not Found 3120 Process not Found 6484 ultramediaburner.tmp 3152 installer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3120 Process not Found 4320 MicrosoftEdge.exe 2908 MicrosoftEdgeCP.exe 2908 MicrosoftEdgeCP.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 3120 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4064 wrote to memory of 2020 4064 8 (7).exe 75 PID 4064 wrote to memory of 2020 4064 8 (7).exe 75 PID 4064 wrote to memory of 2020 4064 8 (7).exe 75 PID 2020 wrote to memory of 2760 2020 setup_installer.exe 76 PID 2020 wrote to memory of 2760 2020 setup_installer.exe 76 PID 2020 wrote to memory of 2760 2020 setup_installer.exe 76 PID 2760 wrote to memory of 1080 2760 setup_install.exe 85 PID 2760 wrote to memory of 1080 2760 setup_install.exe 85 PID 2760 wrote to memory of 1080 2760 setup_install.exe 85 PID 2760 wrote to memory of 3696 2760 setup_install.exe 84 PID 2760 wrote to memory of 3696 2760 setup_install.exe 84 PID 2760 wrote to memory of 3696 2760 setup_install.exe 84 PID 2760 wrote to memory of 3700 2760 setup_install.exe 79 PID 2760 wrote to memory of 3700 2760 setup_install.exe 79 PID 2760 wrote to memory of 3700 2760 setup_install.exe 79 PID 2760 wrote to memory of 4060 2760 setup_install.exe 80 PID 2760 wrote to memory of 4060 2760 setup_install.exe 80 PID 2760 wrote to memory of 4060 2760 setup_install.exe 80 PID 2760 wrote to memory of 1580 2760 setup_install.exe 83 PID 2760 wrote to memory of 1580 2760 setup_install.exe 83 PID 2760 wrote to memory of 1580 2760 setup_install.exe 83 PID 2760 wrote to memory of 3296 2760 setup_install.exe 82 PID 2760 wrote to memory of 3296 2760 setup_install.exe 82 PID 2760 wrote to memory of 3296 2760 setup_install.exe 82 PID 2760 wrote to memory of 3004 2760 setup_install.exe 81 PID 2760 wrote to memory of 3004 2760 setup_install.exe 81 PID 2760 wrote to memory of 3004 2760 setup_install.exe 81 PID 3696 wrote to memory of 4080 3696 cmd.exe 86 PID 3696 wrote to memory of 4080 3696 cmd.exe 86 PID 3696 wrote to memory of 4080 3696 cmd.exe 86 PID 1080 wrote to memory of 1308 1080 cmd.exe 88 PID 1080 wrote to memory of 1308 1080 cmd.exe 88 PID 1080 wrote to memory of 1308 1080 cmd.exe 88 PID 1580 wrote to memory of 3948 1580 cmd.exe 93 PID 1580 wrote to memory of 3948 1580 cmd.exe 93 PID 1580 wrote to memory of 3948 1580 cmd.exe 93 PID 3700 wrote to memory of 3172 3700 cmd.exe 89 PID 3700 wrote to memory of 3172 3700 cmd.exe 89 PID 3700 wrote to memory of 3172 3700 cmd.exe 89 PID 4060 wrote to memory of 1148 4060 cmd.exe 91 PID 4060 wrote to memory of 1148 4060 cmd.exe 91 PID 3296 wrote to memory of 632 3296 cmd.exe 92 PID 3296 wrote to memory of 632 3296 cmd.exe 92 PID 3296 wrote to memory of 632 3296 cmd.exe 92 PID 1308 wrote to memory of 3896 1308 sonia_1.exe 94 PID 1308 wrote to memory of 3896 1308 sonia_1.exe 94 PID 1308 wrote to memory of 3896 1308 sonia_1.exe 94 PID 4124 wrote to memory of 4144 4124 rUNdlL32.eXe 97 PID 4124 wrote to memory of 4144 4124 rUNdlL32.eXe 97 PID 4124 wrote to memory of 4144 4124 rUNdlL32.eXe 97 PID 4144 wrote to memory of 2192 4144 rundll32.exe 70 PID 4144 wrote to memory of 2752 4144 rundll32.exe 15 PID 2192 wrote to memory of 4220 2192 svchost.exe 99 PID 2192 wrote to memory of 4220 2192 svchost.exe 99 PID 2192 wrote to memory of 4220 2192 svchost.exe 99 PID 4144 wrote to memory of 68 4144 rundll32.exe 60 PID 4144 wrote to memory of 2272 4144 rundll32.exe 34 PID 4144 wrote to memory of 2332 4144 rundll32.exe 33 PID 4144 wrote to memory of 1084 4144 rundll32.exe 9 PID 4144 wrote to memory of 932 4144 rundll32.exe 56 PID 4144 wrote to memory of 1356 4144 rundll32.exe 10 PID 4144 wrote to memory of 1892 4144 rundll32.exe 41 PID 4144 wrote to memory of 1196 4144 rundll32.exe 52 PID 4144 wrote to memory of 1288 4144 rundll32.exe 51
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1084
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1356
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2360
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2752
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2384
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2332
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2272
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1892
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1288
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1196
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:932 -
C:\Users\Admin\AppData\Roaming\grdajsbC:\Users\Admin\AppData\Roaming\grdajsb2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5144
-
-
C:\Users\Admin\AppData\Roaming\grdajsbC:\Users\Admin\AppData\Roaming\grdajsb2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5428
-
-
C:\Users\Admin\AppData\Roaming\grdajsbC:\Users\Admin\AppData\Roaming\grdajsb2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:6240
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s gpsvc1⤵PID:68
-
C:\Users\Admin\AppData\Local\Temp\8 (7).exe"C:\Users\Admin\AppData\Local\Temp\8 (7).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4064 -
C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\setup_install.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_3.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_3.exesonia_3.exe5⤵
- Executes dropped EXE
- Modifies system certificate store
PID:3172 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 9046⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4348
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_4.exe4⤵
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_4.exesonia_4.exe5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_7.exe4⤵PID:3004
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_6.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3296 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_6.exesonia_6.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
PID:632 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:1468
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵
- Executes dropped EXE
PID:2508
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:2744
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt6⤵PID:4224
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_5.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_5.exesonia_5.exe5⤵
- Executes dropped EXE
- Checks computer location settings
PID:3948 -
C:\Users\Admin\Documents\mDTtXgOrLcb2Bt9befNUToLr.exe"C:\Users\Admin\Documents\mDTtXgOrLcb2Bt9befNUToLr.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:4976 -
C:\Users\Admin\Documents\mDTtXgOrLcb2Bt9befNUToLr.exeC:\Users\Admin\Documents\mDTtXgOrLcb2Bt9befNUToLr.exe7⤵
- Executes dropped EXE
PID:4492 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4492 -s 248⤵
- Program crash
PID:1864
-
-
-
-
C:\Users\Admin\Documents\BKZGrSUdfW4vPgsbMhjHT57N.exe"C:\Users\Admin\Documents\BKZGrSUdfW4vPgsbMhjHT57N.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4956 -
C:\Users\Admin\Documents\BKZGrSUdfW4vPgsbMhjHT57N.exeC:\Users\Admin\Documents\BKZGrSUdfW4vPgsbMhjHT57N.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4332
-
-
-
C:\Users\Admin\Documents\9xDsKzy1IAdDvUqyTYaPEu6p.exe"C:\Users\Admin\Documents\9xDsKzy1IAdDvUqyTYaPEu6p.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
-
C:\Users\Admin\Documents\HK7IRkfm21iBjYJmT2wvPOFr.exe"C:\Users\Admin\Documents\HK7IRkfm21iBjYJmT2wvPOFr.exe"6⤵
- Executes dropped EXE
PID:5032 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:2972
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:5500
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt7⤵
- Executes dropped EXE
PID:4896
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 5032 -s 7687⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:6104
-
-
-
C:\Users\Admin\Documents\uTNQ3BkypvzDnroeDCFv2saK.exe"C:\Users\Admin\Documents\uTNQ3BkypvzDnroeDCFv2saK.exe"6⤵PID:5084
-
-
C:\Users\Admin\Documents\3ZY093ZJBSUgDBZdHEcgChHk.exe"C:\Users\Admin\Documents\3ZY093ZJBSUgDBZdHEcgChHk.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4548 -
C:\Users\Admin\AppData\Roaming\7527634.exe"C:\Users\Admin\AppData\Roaming\7527634.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4984
-
-
C:\Users\Admin\AppData\Roaming\4239109.exe"C:\Users\Admin\AppData\Roaming\4239109.exe"7⤵
- Executes dropped EXE
PID:2404
-
-
-
C:\Users\Admin\Documents\GNTLK7l7rwDwOTuUIswntJsE.exe"C:\Users\Admin\Documents\GNTLK7l7rwDwOTuUIswntJsE.exe"6⤵PID:4340
-
C:\Users\Admin\AppData\Roaming\7527634.exe"C:\Users\Admin\AppData\Roaming\7527634.exe"7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2576
-
-
C:\Users\Admin\AppData\Roaming\4518041.exe"C:\Users\Admin\AppData\Roaming\4518041.exe"7⤵
- Executes dropped EXE
PID:4092
-
-
-
C:\Users\Admin\Documents\XpQYqP0zpTKhNKedwKvFtfVw.exe"C:\Users\Admin\Documents\XpQYqP0zpTKhNKedwKvFtfVw.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4280
-
-
C:\Users\Admin\Documents\hljnzfj9D7xi6JOhODl0jNnt.exe"C:\Users\Admin\Documents\hljnzfj9D7xi6JOhODl0jNnt.exe"6⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3832 -
C:\Program Files (x86)\Company\NewProduct\customer3.exe"C:\Program Files (x86)\Company\NewProduct\customer3.exe"7⤵
- Executes dropped EXE
- Drops startup file
PID:3476 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:5520
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
PID:5656
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:4904
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
PID:5376
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:5700
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
PID:5080
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:5148
-
-
C:\Users\Admin\AppData\Local\Temp\22222.exeC:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /DeleteCookiesWildcard "*.facebook.com"8⤵
- Executes dropped EXE
PID:5300
-
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"7⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5056
-
-
C:\Program Files (x86)\Company\NewProduct\jooyu.exe"C:\Program Files (x86)\Company\NewProduct\jooyu.exe"7⤵
- Executes dropped EXE
PID:2768 -
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:4388
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵
- Executes dropped EXE
PID:5924
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exeC:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt8⤵PID:732
-
-
-
-
C:\Users\Admin\Documents\NR9ftMafc1hg6nygFAlyWuNd.exe"C:\Users\Admin\Documents\NR9ftMafc1hg6nygFAlyWuNd.exe"6⤵
- Executes dropped EXE
PID:4508 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 6607⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 6727⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4636
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 7807⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4168
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 8247⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 11287⤵
- Executes dropped EXE
- Program crash
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:5084
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 12607⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 13007⤵
- Executes dropped EXE
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4340
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 14127⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:5604
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4508 -s 14807⤵
- Program crash
PID:5820
-
-
-
C:\Users\Admin\Documents\TPYSTmlSnmWbscmgp1GW1cap.exe"C:\Users\Admin\Documents\TPYSTmlSnmWbscmgp1GW1cap.exe"6⤵
- Executes dropped EXE
PID:4996 -
C:\Users\Admin\Documents\TPYSTmlSnmWbscmgp1GW1cap.exe"C:\Users\Admin\Documents\TPYSTmlSnmWbscmgp1GW1cap.exe"7⤵PID:6388
-
-
-
C:\Users\Admin\Documents\hx42SOBt3i_1llFwed3Lvhkh.exe"C:\Users\Admin\Documents\hx42SOBt3i_1llFwed3Lvhkh.exe"6⤵
- Executes dropped EXE
PID:1012 -
C:\Users\Admin\AppData\Local\Temp\is-GM7BU.tmp\hx42SOBt3i_1llFwed3Lvhkh.tmp"C:\Users\Admin\AppData\Local\Temp\is-GM7BU.tmp\hx42SOBt3i_1llFwed3Lvhkh.tmp" /SL5="$40068,138429,56832,C:\Users\Admin\Documents\hx42SOBt3i_1llFwed3Lvhkh.exe"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
PID:1756 -
C:\Users\Admin\AppData\Local\Temp\is-1I7OJ.tmp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\is-1I7OJ.tmp\Setup.exe" /Verysilent8⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:5276 -
C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox32Bit.exe"9⤵
- Executes dropped EXE
PID:5492 -
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:6244
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt10⤵PID:6420
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"9⤵
- Executes dropped EXE
PID:5540 -
C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe"C:\Program Files (x86)\GameBox INC\GameBox\BotCheck.exe" -a10⤵
- Executes dropped EXE
PID:4788
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"C:\Program Files (x86)\GameBox INC\GameBox\note8876.exe"9⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops file in Program Files directory
PID:5624
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"9⤵
- Executes dropped EXE
PID:5688 -
C:\Users\Admin\AppData\Local\Temp\is-GE2F1.tmp\GameBoxWin32.tmp"C:\Users\Admin\AppData\Local\Temp\is-GE2F1.tmp\GameBoxWin32.tmp" /SL5="$40250,506127,422400,C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin32.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5808 -
C:\Users\Admin\AppData\Local\Temp\is-GJRN7.tmp\Daldoula.exe"C:\Users\Admin\AppData\Local\Temp\is-GJRN7.tmp\Daldoula.exe" /S /UID=burnerch211⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in Program Files directory
PID:5660 -
C:\Program Files\MSBuild\PGMIWNEXSM\ultramediaburner.exe"C:\Program Files\MSBuild\PGMIWNEXSM\ultramediaburner.exe" /VERYSILENT12⤵PID:6520
-
C:\Users\Admin\AppData\Local\Temp\is-VPLKE.tmp\ultramediaburner.tmp"C:\Users\Admin\AppData\Local\Temp\is-VPLKE.tmp\ultramediaburner.tmp" /SL5="$60068,281924,62464,C:\Program Files\MSBuild\PGMIWNEXSM\ultramediaburner.exe" /VERYSILENT13⤵
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
PID:6484 -
C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe"C:\Program Files (x86)\UltraMediaBurner\UltraMediaBurner.exe" -silent -desktopShortcut -programMenu14⤵PID:6204
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\02-c1636-0fc-4c192-e507a8271e8d2\Qyshihahadae.exe"C:\Users\Admin\AppData\Local\Temp\02-c1636-0fc-4c192-e507a8271e8d2\Qyshihahadae.exe"12⤵
- Checks computer location settings
PID:6172
-
-
C:\Users\Admin\AppData\Local\Temp\74-20d52-335-6db81-71f81197d0620\Likujyxaelu.exe"C:\Users\Admin\AppData\Local\Temp\74-20d52-335-6db81-71f81197d0620\Likujyxaelu.exe"12⤵PID:5164
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4dvzxzoa.omt\GcleanerEU.exe /eufive & exit13⤵PID:5252
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\40cctyhr.qi1\installer.exe /qn CAMPAIGN="654" & exit13⤵PID:5716
-
C:\Users\Admin\AppData\Local\Temp\40cctyhr.qi1\installer.exeC:\Users\Admin\AppData\Local\Temp\40cctyhr.qi1\installer.exe /qn CAMPAIGN="654"14⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of FindShellTrayWindow
PID:3152 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\40cctyhr.qi1\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\40cctyhr.qi1\ EXE_CMD_LINE="/forcecleanup /wintime 1628204653 /qn CAMPAIGN=""654"" " CAMPAIGN="654"15⤵PID:4124
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\gk50lm1g.h0k\ufgaa.exe & exit13⤵PID:5348
-
C:\Users\Admin\AppData\Local\Temp\gk50lm1g.h0k\ufgaa.exeC:\Users\Admin\AppData\Local\Temp\gk50lm1g.h0k\ufgaa.exe14⤵PID:1516
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:5488
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵
- Modifies data under HKEY_USERS
- Modifies system certificate store
PID:6388
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:4780
-
-
C:\Users\Admin\AppData\Local\Temp\11111.exeC:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt15⤵PID:7020
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hmt1vjqv.e0l\anyname.exe & exit13⤵PID:5752
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV114⤵PID:6420
-
-
C:\Users\Admin\AppData\Local\Temp\hmt1vjqv.e0l\anyname.exeC:\Users\Admin\AppData\Local\Temp\hmt1vjqv.e0l\anyname.exe14⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\hmt1vjqv.e0l\anyname.exe"C:\Users\Admin\AppData\Local\Temp\hmt1vjqv.e0l\anyname.exe" -q15⤵PID:2376
-
-
-
-
-
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" /qn CAMPAIGN="710"9⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:5732 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=710 AI_SETUPEXEPATH="C:\Program Files (x86)\GameBox INC\GameBox\GameBoxWin64.exe" SETUPEXEDIR="C:\Program Files (x86)\GameBox INC\GameBox\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1628204653 /qn CAMPAIGN=""710"" " CAMPAIGN="710"10⤵PID:6116
-
-
-
C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"C:\Program Files (x86)\GameBox INC\GameBox\GameBox.exe"9⤵
- Executes dropped EXE
PID:5592 -
C:\Users\Admin\AppData\Roaming\3925878.exe"C:\Users\Admin\AppData\Roaming\3925878.exe"10⤵
- Executes dropped EXE
PID:5696
-
-
C:\Users\Admin\AppData\Roaming\7328391.exe"C:\Users\Admin\AppData\Roaming\7328391.exe"10⤵
- Executes dropped EXE
- Adds Run key to start application
PID:5784 -
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"11⤵
- Executes dropped EXE
PID:5992
-
-
-
C:\Users\Admin\AppData\Roaming\4624145.exe"C:\Users\Admin\AppData\Roaming\4624145.exe"10⤵
- Executes dropped EXE
PID:6112
-
-
C:\Users\Admin\AppData\Roaming\3481378.exe"C:\Users\Admin\AppData\Roaming\3481378.exe"10⤵
- Executes dropped EXE
PID:5960
-
-
-
-
-
-
C:\Users\Admin\Documents\K7lmuWcia7qPxK7XPMIPIoZy.exe"C:\Users\Admin\Documents\K7lmuWcia7qPxK7XPMIPIoZy.exe"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3464
-
-
C:\Users\Admin\Documents\fNdJ7ZxVTZVxMEEZEPxpgF8k.exe"C:\Users\Admin\Documents\fNdJ7ZxVTZVxMEEZEPxpgF8k.exe"6⤵
- Executes dropped EXE
PID:4728
-
-
C:\Users\Admin\Documents\eFUQhtnuFewP5MM0FU30eR02.exe"C:\Users\Admin\Documents\eFUQhtnuFewP5MM0FU30eR02.exe"6⤵
- Executes dropped EXE
PID:4228 -
C:\Users\Admin\Documents\eFUQhtnuFewP5MM0FU30eR02.exe"C:\Users\Admin\Documents\eFUQhtnuFewP5MM0FU30eR02.exe" -q7⤵
- Executes dropped EXE
PID:4524
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_2.exe4⤵
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_2.exesonia_2.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4080
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c sonia_1.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_1.exesonia_1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_1.exe"C:\Users\Admin\AppData\Local\Temp\7zS4E7B2224\sonia_1.exe" -a6⤵
- Executes dropped EXE
PID:3896
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 4564⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Checks processor information in registry
- Modifies registry class
PID:4220
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
PID:3868
-
-
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
- Suspicious use of WriteProcessMemory
PID:4124
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6072 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:6100
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:2920 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding C7980AFBFB0F1489FC02D4993FE6A698 C2⤵
- Loads dropped DLL
PID:5292
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 209282659BBBB319CE90B01DB938EA992⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:6180 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:6444
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 76B64E74168E421D1D9C545F1CB6A6BA E Global\MSI00002⤵
- Loads dropped DLL
PID:7012
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 38C1E43F6A67E19541E7C6CEAAF39B20 C2⤵
- Loads dropped DLL
PID:684
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding E09F445E997CDCD692D000D37B6C891B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
PID:7084 -
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:4920
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 1FE4E4A5406105A718E3AEB58BB42C7F E Global\MSI00002⤵
- Loads dropped DLL
PID:6316
-
-
C:\Windows\system32\rUNdlL32.eXerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main1⤵
- Process spawned unexpected child process
PID:5144 -
C:\Windows\SysWOW64\rundll32.exerUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main2⤵
- Loads dropped DLL
PID:5088
-
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
PID:6248
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4320
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:4984
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:2908
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
PID:6972
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:5532 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:580
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5744
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6420
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5024
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4620
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4812
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4384
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4180
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7096
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4081⤵PID:7060
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6404
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6184
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2780
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4580
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:5400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:6400
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:2444