Overview
overview
10Static
static
Setup (1).exe
windows7_x64
Setup (1).exe
windows10_x64
10Setup (10).exe
windows7_x64
10Setup (10).exe
windows10_x64
10Setup (11).exe
windows7_x64
Setup (11).exe
windows10_x64
10Setup (12).exe
windows7_x64
Setup (12).exe
windows10_x64
10Setup (13).exe
windows7_x64
10Setup (13).exe
windows10_x64
10Setup (14).exe
windows7_x64
10Setup (14).exe
windows10_x64
10Setup (15).exe
windows7_x64
10Setup (15).exe
windows10_x64
10Setup (16).exe
windows7_x64
10Setup (16).exe
windows10_x64
10Setup (17).exe
windows7_x64
10Setup (17).exe
windows10_x64
10Setup (18).exe
windows7_x64
10Setup (18).exe
windows10_x64
10Setup (19).exe
windows7_x64
10Setup (19).exe
windows10_x64
10Setup (2).exe
windows7_x64
10Setup (2).exe
windows10_x64
10Setup (20).exe
windows7_x64
10Setup (20).exe
windows10_x64
10Setup (21).exe
windows7_x64
Setup (21).exe
windows10_x64
10Setup (22).exe
windows7_x64
Setup (22).exe
windows10_x64
10Setup (23).exe
windows7_x64
10Setup (23).exe
windows10_x64
10Resubmissions
15/10/2024, 15:36
241015-s1zlzasdkc 1001/07/2024, 18:32
240701-w6yteawhmq 1001/07/2024, 14:52
240701-r82wmaxdnd 1001/07/2024, 14:52
240701-r8syqa1dpp 1011/03/2024, 21:22
240311-z8dsssgg58 1001/09/2021, 13:18
210901-5bmxjspa5s 1001/09/2021, 13:04
210901-te4btfspqa 1001/09/2021, 05:12
210901-4wnkwm1p3j 1031/08/2021, 21:47
210831-41rp97dma2 10Analysis
-
max time kernel
1794s -
max time network
1847s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27/08/2021, 15:40
Static task
static1
Behavioral task
behavioral1
Sample
Setup (1).exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Setup (1).exe
Resource
win10v20210408
Behavioral task
behavioral3
Sample
Setup (10).exe
Resource
win7v20210410
Behavioral task
behavioral4
Sample
Setup (10).exe
Resource
win10v20210408
Behavioral task
behavioral5
Sample
Setup (11).exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Setup (11).exe
Resource
win10v20210410
Behavioral task
behavioral7
Sample
Setup (12).exe
Resource
win7v20210408
Behavioral task
behavioral8
Sample
Setup (12).exe
Resource
win10v20210410
Behavioral task
behavioral9
Sample
Setup (13).exe
Resource
win7v20210408
Behavioral task
behavioral10
Sample
Setup (13).exe
Resource
win10v20210410
Behavioral task
behavioral11
Sample
Setup (14).exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup (14).exe
Resource
win10v20210408
Behavioral task
behavioral13
Sample
Setup (15).exe
Resource
win7v20210410
Behavioral task
behavioral14
Sample
Setup (15).exe
Resource
win10v20210408
Behavioral task
behavioral15
Sample
Setup (16).exe
Resource
win7v20210410
Behavioral task
behavioral16
Sample
Setup (16).exe
Resource
win10v20210408
Behavioral task
behavioral17
Sample
Setup (17).exe
Resource
win7v20210410
Behavioral task
behavioral18
Sample
Setup (17).exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
Setup (18).exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
Setup (18).exe
Resource
win10v20210410
Behavioral task
behavioral21
Sample
Setup (19).exe
Resource
win7v20210408
Behavioral task
behavioral22
Sample
Setup (19).exe
Resource
win10v20210410
Behavioral task
behavioral23
Sample
Setup (2).exe
Resource
win7v20210408
Behavioral task
behavioral24
Sample
Setup (2).exe
Resource
win10v20210410
Behavioral task
behavioral25
Sample
Setup (20).exe
Resource
win7v20210410
Behavioral task
behavioral26
Sample
Setup (20).exe
Resource
win10v20210408
Behavioral task
behavioral27
Sample
Setup (21).exe
Resource
win7v20210410
Behavioral task
behavioral28
Sample
Setup (21).exe
Resource
win10v20210408
Behavioral task
behavioral29
Sample
Setup (22).exe
Resource
win7v20210410
Behavioral task
behavioral30
Sample
Setup (22).exe
Resource
win10v20210408
Behavioral task
behavioral31
Sample
Setup (23).exe
Resource
win7v20210410
Behavioral task
behavioral32
Sample
Setup (23).exe
Resource
win10v20210410
General
-
Target
Setup (17).exe
-
Size
631KB
-
MD5
cb927513ff8ebff4dd52a47f7e42f934
-
SHA1
0de47c02a8adc4940a6c18621b4e4a619641d029
-
SHA256
fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f
-
SHA512
988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c
Malware Config
Extracted
redline
installs8912
185.186.142.245:22850
Extracted
redline
dibild2
135.148.139.222:1494
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2648 2516 rundll32.exe 66 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral17/memory/2856-185-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral17/memory/2840-184-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral17/memory/2856-187-0x000000000041A6BE-mapping.dmp family_redline behavioral17/memory/2840-188-0x000000000041A616-mapping.dmp family_redline behavioral17/memory/2840-189-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 37 IoCs
pid Process 1028 RkzRHpEcftQFc629yZL3fAnQ.exe 1836 kcY0QZMjGjDBJuZg4R0gk37i.exe 912 1okqw5E4MwJBeTVdOyOThRq8.exe 2020 gkkVBQbot_VmlULV5lC8HxMs.exe 1624 13QCYBEXSR9T6nc5z9IfU5Ww.exe 1616 RUv1ddMqDVXnMBTCQ1DUg0OK.exe 1320 3H4kTacwyxcb3iagBSljOOEh.exe 1900 vO6zw8XWz5eqyAMTnSkj_WE6.exe 1988 txwRD3fwUIS5bR3zTnkNk7Mf.exe 1516 FpVWobnTT8WEACUXe993RjEM.exe 2032 GQD6UNc1kqiMq3UD5es3Ynry.exe 332 mPBuP_yfGDqZnRJ4GVvpmNdM.exe 316 pk7QweK2QT4ovTS_4nY6CJsF.exe 1696 xTmcFS1XDVP5k71ZLB7FxnIu.exe 1720 xfHlBKMLOY5rB1N4Gio_WPH8.exe 1548 wumrKLPuusYqR011UosnmEDQ.exe 1888 z35Ir95a4g3zZtj8hK1rUDW9.exe 2044 SMEqZuKHaXwHERNplQPCvvnl.exe 2040 Bo5XPAzrgWGp8VgChYONA5Wi.exe 896 ZzjjTYkGe9hCBETMTpSrz7zF.exe 1896 J4XuzgaDVgt657g6ewVRFyIN.exe 1612 ihg36LJJwelK_g3pZBpz56ZV.exe 2080 qFP9z8SFnnVUYEwlam0qTJQN.exe 2064 2Xa1NkZbh1qDpBnQqvd0omwz.exe 1980 Ew7JZY4RgqN1IbPG6MelKqIv.exe 2840 gkkVBQbot_VmlULV5lC8HxMs.exe 3012 jX2qxUF4.com 2820 E003.exe 1708 rheiaes 1400 6r4kF9SU7lbCxrLdafNQVIxp.exe 668 mPBuP_yfGDqZnRJ4GVvpmNdM.exe 3008 cutm3.exe 2448 md8_8eus.exe 2252 inst1.exe 892 E003.exe 436 rheiaes 2620 E003.exe -
Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion txwRD3fwUIS5bR3zTnkNk7Mf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion txwRD3fwUIS5bR3zTnkNk7Mf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion qFP9z8SFnnVUYEwlam0qTJQN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion qFP9z8SFnnVUYEwlam0qTJQN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2Xa1NkZbh1qDpBnQqvd0omwz.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2Xa1NkZbh1qDpBnQqvd0omwz.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Control Panel\International\Geo\Nation Setup (17).exe -
Loads dropped DLL 54 IoCs
pid Process 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 1660 Setup (17).exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 2672 rundll32.exe 1896 J4XuzgaDVgt657g6ewVRFyIN.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 1900 WerFault.exe 1612 ihg36LJJwelK_g3pZBpz56ZV.exe 1612 ihg36LJJwelK_g3pZBpz56ZV.exe 1612 ihg36LJJwelK_g3pZBpz56ZV.exe 2820 E003.exe 892 E003.exe 892 E003.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 188 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral17/files/0x00030000000131b5-136.dat themida behavioral17/files/0x00030000000131f2-133.dat themida behavioral17/files/0x00030000000131ff-131.dat themida behavioral17/files/0x00030000000131b5-85.dat themida behavioral17/files/0x00030000000131f2-154.dat themida behavioral17/memory/2080-199-0x0000000000E30000-0x0000000000E31000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9051e84d-3791-4512-984c-971887ed715b\\E003.exe\" --AutoStart" E003.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA txwRD3fwUIS5bR3zTnkNk7Mf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2Xa1NkZbh1qDpBnQqvd0omwz.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA qFP9z8SFnnVUYEwlam0qTJQN.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 202 api.2ip.ua 203 api.2ip.ua 21 ipinfo.io 22 ipinfo.io -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 2064 2Xa1NkZbh1qDpBnQqvd0omwz.exe 1988 txwRD3fwUIS5bR3zTnkNk7Mf.exe 2080 qFP9z8SFnnVUYEwlam0qTJQN.exe -
Suspicious use of SetThreadContext 5 IoCs
description pid Process procid_target PID 1836 set thread context of 2692 1836 kcY0QZMjGjDBJuZg4R0gk37i.exe 69 PID 2020 set thread context of 2840 2020 gkkVBQbot_VmlULV5lC8HxMs.exe 70 PID 1896 set thread context of 2856 1896 J4XuzgaDVgt657g6ewVRFyIN.exe 71 PID 2020 set thread context of 2932 2020 gkkVBQbot_VmlULV5lC8HxMs.exe 72 PID 2820 set thread context of 892 2820 E003.exe 94 -
Drops file in Program Files directory 5 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Company\NewProduct\cutm3.exe ihg36LJJwelK_g3pZBpz56ZV.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe ihg36LJJwelK_g3pZBpz56ZV.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\inst1.exe ihg36LJJwelK_g3pZBpz56ZV.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe ihg36LJJwelK_g3pZBpz56ZV.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini ihg36LJJwelK_g3pZBpz56ZV.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe Process not Found -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1900 1320 WerFault.exe 47 -
Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SMEqZuKHaXwHERNplQPCvvnl.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SMEqZuKHaXwHERNplQPCvvnl.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI SMEqZuKHaXwHERNplQPCvvnl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI rheiaes -
Kills process with taskkill 1 IoCs
pid Process 608 taskkill.exe -
Modifies data under HKEY_USERS 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-391 = "Arab Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-361 = "GTB Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-741 = "New Zealand Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-12 = "Azores Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-732 = "Fiji Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-182 = "Mountain Standard Time (Mexico)" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-602 = "Taipei Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-721 = "Central Pacific Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-262 = "GMT Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-671 = "AUS Eastern Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-41 = "E. South America Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-492 = "India Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-1412 = "Syria Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-592 = "Malay Peninsula Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-662 = "Cen. Australia Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-335 = "Jordan Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-161 = "Central Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-912 = "Mauritius Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-241 = "Samoa Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-672 = "AUS Eastern Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-251 = "Dateline Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-682 = "E. Australia Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-472 = "Ekaterinburg Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-532 = "Sri Lanka Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-502 = "Nepal Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-501 = "Nepal Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-421 = "Russian Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-451 = "Caucasus Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-171 = "Central Daylight Time (Mexico)" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-572 = "China Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-692 = "Tasmania Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-531 = "Sri Lanka Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-142 = "Canada Central Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-292 = "Central European Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-962 = "Paraguay Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-122 = "SA Pacific Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-252 = "Dateline Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-622 = "Korea Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs mPBuP_yfGDqZnRJ4GVvpmNdM.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-442 = "Arabian Standard Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-104 = "Central Brazilian Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25\52C64B7E\C:\Windows\system32\,@tzres.dll,-211 = "Pacific Daylight Time" mPBuP_yfGDqZnRJ4GVvpmNdM.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C Setup (17).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 0f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802025300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c00b000000010000001600000047006c006f00620061006c005300690067006e000000140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (17).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 Setup (17).exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\B1BC968BD4F49D622AA89A81F2150152A41D829C\Blob = 190000000100000010000000a823b4a20180beb460cab955c24d7e21030000000100000014000000b1bc968bd4f49d622aa89a81f2150152a41d829c1d00000001000000100000006ee7f3b060d10e90a31ba3471b999236140000000100000014000000607b661a450d97ca89502f7d04cd34a8fffcfd4b0b000000010000001600000047006c006f00620061006c005300690067006e0000005300000001000000230000003021301f06092b06010401a032010130123010060a2b0601040182373c0101030200c0090000000100000068000000306606082b0601050507030106082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030806082b06010505070309060a2b0601040182370a030406082b0601050507030606082b0601050507030706082b060105050802020f00000001000000140000005a6d07b6371d966a2fb6ba92828ce5512a49513d200000000100000079030000308203753082025da003020102020b040000000001154b5ac394300d06092a864886f70d01010505003057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f74204341301e170d3938303930313132303030305a170d3238303132383132303030305a3057310b300906035504061302424531193017060355040a1310476c6f62616c5369676e206e762d73613110300e060355040b1307526f6f74204341311b301906035504031312476c6f62616c5369676e20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100da0ee6998dcea3e34f8a7efbf18b83256bea481ff12ab0b9951104bdf063d1e26766cf1cddcf1b482bee8d898e9aaf298065abe9c72d12cbab1c4c7007a13d0a30cd158d4ff8ddd48c50151cef50eec42ef7fce952f2917de06dd535308e5e4373f241e9d56ae3b2893a5639386f063c88695b2a4dc5a754b86c89cc9bf93ccae5fd89f5123c927896d6dc746e934461d18dc746b2750e86e8198ad56d6cd5781695a2e9c80a38ebf224134f73549313853a1bbc1e34b58b058cb9778bb1db1f2091ab09536e90ce7b3774b97047912251631679aeb1ae412608c8192bd146aa48d6642ad78334ff2c2ac16c19434a0785e7d37cf62168efeaf2529f7f9390cf0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e04160414607b661a450d97ca89502f7d04cd34a8fffcfd4b300d06092a864886f70d01010505000382010100d673e77c4f76d08dbfecbaa2be34c52832b57cfc6c9c2c2bbd099e53bf6b5eaa1148b6e508a3b3ca3d614dd34609b33ec3a0e363551bf2baefad39e143b938a3e62f8a263befa05056f9c60afd38cdc40b705194979804dfc35f94d515c914419cc45d7564150dff5530ec868fff0def2cb96346f6aafcdfbc69fd2e1248649ae095f0a6ef298f01b115b50c1da5fe692c6924781eb3a71c7162eecac897ac175d8ac2f847866e2ac4563195d06789852bf96ca65d469d0caa82e49951dd70b7db563d61e46ae15cd6f6fe3dde41cc07ae6352bf5353f42be9c7fdb6f7825f85d24118db81b3041cc51fa4806f1520c9de0c880a1dd66655e2fc48c9292669e0 Setup (17).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 E003.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 Setup (17).exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 qFP9z8SFnnVUYEwlam0qTJQN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e qFP9z8SFnnVUYEwlam0qTJQN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e qFP9z8SFnnVUYEwlam0qTJQN.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e E003.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 135 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 Setup (17).exe 2044 SMEqZuKHaXwHERNplQPCvvnl.exe 2044 SMEqZuKHaXwHERNplQPCvvnl.exe 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found 1264 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1264 Process not Found 1900 WerFault.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2044 SMEqZuKHaXwHERNplQPCvvnl.exe 1708 rheiaes 436 rheiaes -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeDebugPrivilege 608 taskkill.exe Token: SeDebugPrivilege 2080 qFP9z8SFnnVUYEwlam0qTJQN.exe Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeDebugPrivilege 332 mPBuP_yfGDqZnRJ4GVvpmNdM.exe Token: SeImpersonatePrivilege 332 mPBuP_yfGDqZnRJ4GVvpmNdM.exe Token: SeDebugPrivilege 1900 WerFault.exe Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found Token: SeShutdownPrivilege 1264 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1264 Process not Found 1264 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1660 wrote to memory of 1836 1660 Setup (17).exe 34 PID 1660 wrote to memory of 1836 1660 Setup (17).exe 34 PID 1660 wrote to memory of 1836 1660 Setup (17).exe 34 PID 1660 wrote to memory of 1836 1660 Setup (17).exe 34 PID 1660 wrote to memory of 2020 1660 Setup (17).exe 32 PID 1660 wrote to memory of 2020 1660 Setup (17).exe 32 PID 1660 wrote to memory of 2020 1660 Setup (17).exe 32 PID 1660 wrote to memory of 2020 1660 Setup (17).exe 32 PID 1660 wrote to memory of 912 1660 Setup (17).exe 31 PID 1660 wrote to memory of 912 1660 Setup (17).exe 31 PID 1660 wrote to memory of 912 1660 Setup (17).exe 31 PID 1660 wrote to memory of 912 1660 Setup (17).exe 31 PID 1660 wrote to memory of 1624 1660 Setup (17).exe 48 PID 1660 wrote to memory of 1624 1660 Setup (17).exe 48 PID 1660 wrote to memory of 1624 1660 Setup (17).exe 48 PID 1660 wrote to memory of 1624 1660 Setup (17).exe 48 PID 1660 wrote to memory of 1616 1660 Setup (17).exe 46 PID 1660 wrote to memory of 1616 1660 Setup (17).exe 46 PID 1660 wrote to memory of 1616 1660 Setup (17).exe 46 PID 1660 wrote to memory of 1616 1660 Setup (17).exe 46 PID 1660 wrote to memory of 1320 1660 Setup (17).exe 47 PID 1660 wrote to memory of 1320 1660 Setup (17).exe 47 PID 1660 wrote to memory of 1320 1660 Setup (17).exe 47 PID 1660 wrote to memory of 1320 1660 Setup (17).exe 47 PID 1660 wrote to memory of 1516 1660 Setup (17).exe 42 PID 1660 wrote to memory of 1516 1660 Setup (17).exe 42 PID 1660 wrote to memory of 1516 1660 Setup (17).exe 42 PID 1660 wrote to memory of 1516 1660 Setup (17).exe 42 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1988 1660 Setup (17).exe 45 PID 1660 wrote to memory of 1256 1660 Setup (17).exe 41 PID 1660 wrote to memory of 1256 1660 Setup (17).exe 41 PID 1660 wrote to memory of 1256 1660 Setup (17).exe 41 PID 1660 wrote to memory of 1256 1660 Setup (17).exe 41 PID 1660 wrote to memory of 1900 1660 Setup (17).exe 44 PID 1660 wrote to memory of 1900 1660 Setup (17).exe 44 PID 1660 wrote to memory of 1900 1660 Setup (17).exe 44 PID 1660 wrote to memory of 1900 1660 Setup (17).exe 44 PID 1660 wrote to memory of 1400 1660 Setup (17).exe 40 PID 1660 wrote to memory of 1400 1660 Setup (17).exe 40 PID 1660 wrote to memory of 1400 1660 Setup (17).exe 40 PID 1660 wrote to memory of 1400 1660 Setup (17).exe 40 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 1980 1660 Setup (17).exe 39 PID 1660 wrote to memory of 316 1660 Setup (17).exe 38 PID 1660 wrote to memory of 316 1660 Setup (17).exe 38 PID 1660 wrote to memory of 316 1660 Setup (17).exe 38 PID 1660 wrote to memory of 316 1660 Setup (17).exe 38 PID 1660 wrote to memory of 2032 1660 Setup (17).exe 43 PID 1660 wrote to memory of 2032 1660 Setup (17).exe 43 PID 1660 wrote to memory of 2032 1660 Setup (17).exe 43 PID 1660 wrote to memory of 2032 1660 Setup (17).exe 43 PID 1660 wrote to memory of 332 1660 Setup (17).exe 37 PID 1660 wrote to memory of 332 1660 Setup (17).exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup (17).exe"C:\Users\Admin\AppData\Local\Temp\Setup (17).exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Users\Admin\Documents\1okqw5E4MwJBeTVdOyOThRq8.exe"C:\Users\Admin\Documents\1okqw5E4MwJBeTVdOyOThRq8.exe"2⤵
- Executes dropped EXE
PID:912
-
-
C:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exe"C:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2020 -
C:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exeC:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exe3⤵
- Executes dropped EXE
PID:2840
-
-
C:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exeC:\Users\Admin\Documents\gkkVBQbot_VmlULV5lC8HxMs.exe3⤵PID:2932
-
-
-
C:\Users\Admin\Documents\RkzRHpEcftQFc629yZL3fAnQ.exe"C:\Users\Admin\Documents\RkzRHpEcftQFc629yZL3fAnQ.exe"2⤵
- Executes dropped EXE
PID:1028
-
-
C:\Users\Admin\Documents\kcY0QZMjGjDBJuZg4R0gk37i.exe"C:\Users\Admin\Documents\kcY0QZMjGjDBJuZg4R0gk37i.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1836 -
C:\Users\Admin\Documents\kcY0QZMjGjDBJuZg4R0gk37i.exe"C:\Users\Admin\Documents\kcY0QZMjGjDBJuZg4R0gk37i.exe"3⤵PID:2692
-
-
-
C:\Users\Admin\Documents\xTmcFS1XDVP5k71ZLB7FxnIu.exe"C:\Users\Admin\Documents\xTmcFS1XDVP5k71ZLB7FxnIu.exe"2⤵
- Executes dropped EXE
PID:1696
-
-
C:\Users\Admin\Documents\mPBuP_yfGDqZnRJ4GVvpmNdM.exe"C:\Users\Admin\Documents\mPBuP_yfGDqZnRJ4GVvpmNdM.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Users\Admin\Documents\mPBuP_yfGDqZnRJ4GVvpmNdM.exe"C:\Users\Admin\Documents\mPBuP_yfGDqZnRJ4GVvpmNdM.exe"3⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:668
-
-
-
C:\Users\Admin\Documents\pk7QweK2QT4ovTS_4nY6CJsF.exe"C:\Users\Admin\Documents\pk7QweK2QT4ovTS_4nY6CJsF.exe"2⤵
- Executes dropped EXE
PID:316 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "pk7QweK2QT4ovTS_4nY6CJsF.exe" /f & erase "C:\Users\Admin\Documents\pk7QweK2QT4ovTS_4nY6CJsF.exe" & exit3⤵PID:2984
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "pk7QweK2QT4ovTS_4nY6CJsF.exe" /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:608
-
-
-
-
C:\Users\Admin\Documents\Ew7JZY4RgqN1IbPG6MelKqIv.exe"C:\Users\Admin\Documents\Ew7JZY4RgqN1IbPG6MelKqIv.exe"2⤵
- Executes dropped EXE
PID:1980
-
-
C:\Users\Admin\Documents\6r4kF9SU7lbCxrLdafNQVIxp.exe"C:\Users\Admin\Documents\6r4kF9SU7lbCxrLdafNQVIxp.exe"2⤵
- Executes dropped EXE
PID:1400
-
-
C:\Users\Admin\Documents\aPnPfyggn8qTJQJJ8buBupMf.exe"C:\Users\Admin\Documents\aPnPfyggn8qTJQJJ8buBupMf.exe"2⤵PID:1256
-
-
C:\Users\Admin\Documents\FpVWobnTT8WEACUXe993RjEM.exe"C:\Users\Admin\Documents\FpVWobnTT8WEACUXe993RjEM.exe"2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\Documents\GQD6UNc1kqiMq3UD5es3Ynry.exe"C:\Users\Admin\Documents\GQD6UNc1kqiMq3UD5es3Ynry.exe"2⤵
- Executes dropped EXE
PID:2032
-
-
C:\Users\Admin\Documents\vO6zw8XWz5eqyAMTnSkj_WE6.exe"C:\Users\Admin\Documents\vO6zw8XWz5eqyAMTnSkj_WE6.exe"2⤵
- Executes dropped EXE
PID:1900
-
-
C:\Users\Admin\Documents\txwRD3fwUIS5bR3zTnkNk7Mf.exe"C:\Users\Admin\Documents\txwRD3fwUIS5bR3zTnkNk7Mf.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1988
-
-
C:\Users\Admin\Documents\RUv1ddMqDVXnMBTCQ1DUg0OK.exe"C:\Users\Admin\Documents\RUv1ddMqDVXnMBTCQ1DUg0OK.exe"2⤵
- Executes dropped EXE
PID:1616 -
C:\Users\Admin\AppData\Local\Temp\jX2qxUF4.com"C:\Users\Admin\AppData\Local\Temp\jX2qxUF4.com"3⤵
- Executes dropped EXE
PID:3012 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\F73A.tmp\F74B.tmp\F74C.bat C:\Users\Admin\AppData\Local\Temp\jX2qxUF4.com"4⤵PID:2108
-
-
-
C:\Users\Admin\AppData\Local\Temp\tHEvn2do.com"C:\Users\Admin\AppData\Local\Temp\tHEvn2do.com"3⤵PID:548
-
-
-
C:\Users\Admin\Documents\3H4kTacwyxcb3iagBSljOOEh.exe"C:\Users\Admin\Documents\3H4kTacwyxcb3iagBSljOOEh.exe"2⤵
- Executes dropped EXE
PID:1320 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 8523⤵
- Loads dropped DLL
- Program crash
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1900
-
-
-
C:\Users\Admin\Documents\13QCYBEXSR9T6nc5z9IfU5Ww.exe"C:\Users\Admin\Documents\13QCYBEXSR9T6nc5z9IfU5Ww.exe"2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\Documents\qFP9z8SFnnVUYEwlam0qTJQN.exe"C:\Users\Admin\Documents\qFP9z8SFnnVUYEwlam0qTJQN.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
C:\Users\Admin\Documents\2Xa1NkZbh1qDpBnQqvd0omwz.exe"C:\Users\Admin\Documents\2Xa1NkZbh1qDpBnQqvd0omwz.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2064
-
-
C:\Users\Admin\Documents\Bo5XPAzrgWGp8VgChYONA5Wi.exe"C:\Users\Admin\Documents\Bo5XPAzrgWGp8VgChYONA5Wi.exe"2⤵
- Executes dropped EXE
PID:2040
-
-
C:\Users\Admin\Documents\ihg36LJJwelK_g3pZBpz56ZV.exe"C:\Users\Admin\Documents\ihg36LJJwelK_g3pZBpz56ZV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
PID:1612 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:3008
-
-
C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"3⤵
- Executes dropped EXE
PID:2448
-
-
C:\Program Files (x86)\Company\NewProduct\inst1.exe"C:\Program Files (x86)\Company\NewProduct\inst1.exe"3⤵
- Executes dropped EXE
PID:2252
-
-
-
C:\Users\Admin\Documents\z35Ir95a4g3zZtj8hK1rUDW9.exe"C:\Users\Admin\Documents\z35Ir95a4g3zZtj8hK1rUDW9.exe"2⤵
- Executes dropped EXE
PID:1888
-
-
C:\Users\Admin\Documents\ZzjjTYkGe9hCBETMTpSrz7zF.exe"C:\Users\Admin\Documents\ZzjjTYkGe9hCBETMTpSrz7zF.exe"2⤵
- Executes dropped EXE
PID:896
-
-
C:\Users\Admin\Documents\SMEqZuKHaXwHERNplQPCvvnl.exe"C:\Users\Admin\Documents\SMEqZuKHaXwHERNplQPCvvnl.exe"2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2044
-
-
C:\Users\Admin\Documents\J4XuzgaDVgt657g6ewVRFyIN.exe"C:\Users\Admin\Documents\J4XuzgaDVgt657g6ewVRFyIN.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:1896 -
C:\Users\Admin\Documents\J4XuzgaDVgt657g6ewVRFyIN.exe"C:\Users\Admin\Documents\J4XuzgaDVgt657g6ewVRFyIN.exe"3⤵PID:2856
-
-
-
C:\Users\Admin\Documents\HAkIdk8zFN5XuQK3GjOgwFjU.exe"C:\Users\Admin\Documents\HAkIdk8zFN5XuQK3GjOgwFjU.exe"2⤵PID:1560
-
-
C:\Users\Admin\Documents\wumrKLPuusYqR011UosnmEDQ.exe"C:\Users\Admin\Documents\wumrKLPuusYqR011UosnmEDQ.exe"2⤵
- Executes dropped EXE
PID:1548
-
-
C:\Users\Admin\Documents\xfHlBKMLOY5rB1N4Gio_WPH8.exe"C:\Users\Admin\Documents\xfHlBKMLOY5rB1N4Gio_WPH8.exe"2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2648 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Loads dropped DLL
PID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\E003.exeC:\Users\Admin\AppData\Local\Temp\E003.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
PID:2820 -
C:\Users\Admin\AppData\Local\Temp\E003.exeC:\Users\Admin\AppData\Local\Temp\E003.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
PID:892 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\9051e84d-3791-4512-984c-971887ed715b" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:188
-
-
C:\Users\Admin\AppData\Local\Temp\E003.exe"C:\Users\Admin\AppData\Local\Temp\E003.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
PID:2620
-
-
-
C:\Users\Admin\AppData\Local\Temp\F8E1.exeC:\Users\Admin\AppData\Local\Temp\F8E1.exe1⤵PID:3052
-
C:\Windows\system32\taskeng.exetaskeng.exe {69C3552A-43A4-40A4-883D-504D8821BEA9} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:1292
-
C:\Users\Admin\AppData\Roaming\rheiaesC:\Users\Admin\AppData\Roaming\rheiaes2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1708
-
-
C:\Users\Admin\AppData\Roaming\rheiaesC:\Users\Admin\AppData\Roaming\rheiaes2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:436
-
Network
MITRE ATT&CK Enterprise v6
Defense Evasion
Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
3Virtualization/Sandbox Evasion
1