Malware Analysis Report

2024-11-30 19:36

Sample ID 220213-pcjn3ahfg2
Target 929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7
SHA256 929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7
Tags
rms evasion rat trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7

Threat Level: Known bad

The file 929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7 was found to be: Known bad.

Malicious Activity Summary

rms evasion rat trojan

RMS

UAC bypass

Executes dropped EXE

Deletes itself

Loads dropped DLL

Checks whether UAC is enabled

Drops file in Program Files directory

Drops file in Windows directory

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: SetClipboardViewer

Suspicious use of WriteProcessMemory

Checks processor information in registry

Runs .reg file with regedit

System policy modification

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-13 12:10

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-13 12:10

Reported

2022-02-13 12:13

Platform

win7-en-20211208

Max time kernel

156s

Max time network

176s

Command Line

"C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

Signatures

RMS

trojan rat rms

UAC bypass

evasion trojan

Deletes itself

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\cmd.exe N/A

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\JavaSE\sys.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\taskmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\settings.ini C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\regedit.reg C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\settings.ini C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\driversmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\sys.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\taskmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\driversmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\regedit.reg C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Enumerates physical storage devices

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\JavaSE\driversmgs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1452 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 268 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1324 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 820 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 1148 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 1452 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1452 wrote to memory of 1196 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1952 wrote to memory of 1664 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1520 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1664 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1664 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1664 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1520 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1520 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1952 wrote to memory of 1520 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1452 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 1452 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 1452 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 1452 wrote to memory of 2020 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 1664 wrote to memory of 1840 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1664 wrote to memory of 1840 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1664 wrote to memory of 1840 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1664 wrote to memory of 1840 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1452 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 1452 wrote to memory of 896 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe

"C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\Program Files\JavaSE\regedit.reg"

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /silentinstall

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /firewall

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\Program Files\JavaSE\regedit.reg"

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /start

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe"

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe" /tray

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe"

C:\Program Files\JavaSE\sys.exe

"C:\Program Files\JavaSE\sys.exe"

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe" /tray

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp

Files

memory/1452-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

memory/1452-55-0x0000000000400000-0x0000000000E30000-memory.dmp

C:\Program Files\JavaSE\regedit.reg

MD5 b6b4fd34f7a392985ad155c56ed73ffa
SHA1 2aeb0d7fcc1db7de8298645af6d502a89cdc25fe
SHA256 ac045b265f35608d6c41fae74503423bad9d10894fea9c147b5544004055f23b
SHA512 2bed3fb87ffaccba1ee739f89e950198d834e3b10a99daaf77bc5a3736d3554fbe1660c6313f5bccbc0291d2688d7c5d5d363f206feb0d2ecf86b599cf6bef23

\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

C:\Program Files\JavaSE\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

\Program Files\JavaSE\sys.exe

MD5 c1f5f8b110cce7f10277c630f242ac24
SHA1 6e7b88221816cba0a098bad6318b1fae6fc74ec6
SHA256 e65c571a758aa024f9c03b8367e3b6762b53f4ba4049f725a6d3cd79c6849dde
SHA512 7c9c777561a4eed10beee6598e3bcec593d7d5fd9e00460dc7635235056f81ab201a0fd5058aeda603580ab874c3d1183737b6a7e040b2985582e87c631eb560

C:\Program Files\JavaSE\sys.exe

MD5 c1f5f8b110cce7f10277c630f242ac24
SHA1 6e7b88221816cba0a098bad6318b1fae6fc74ec6
SHA256 e65c571a758aa024f9c03b8367e3b6762b53f4ba4049f725a6d3cd79c6849dde
SHA512 7c9c777561a4eed10beee6598e3bcec593d7d5fd9e00460dc7635235056f81ab201a0fd5058aeda603580ab874c3d1183737b6a7e040b2985582e87c631eb560

memory/2020-83-0x0000000000400000-0x000000000093355C-memory.dmp

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

memory/2020-89-0x0000000000401000-0x0000000000742000-memory.dmp

memory/2020-90-0x0000000002300000-0x0000000002626000-memory.dmp

memory/2020-92-0x00000000002B0000-0x00000000002B6000-memory.dmp

memory/2020-91-0x00000000002C0000-0x00000000002C3000-memory.dmp

memory/1452-93-0x0000000000400000-0x0000000000E30000-memory.dmp

memory/1520-94-0x00000000001C0000-0x00000000001C1000-memory.dmp

memory/1952-95-0x0000000000230000-0x0000000000231000-memory.dmp

memory/1664-96-0x00000000001C0000-0x00000000001C1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-13 12:10

Reported

2022-02-13 12:13

Platform

win10v2004-en-20220112

Max time kernel

155s

Max time network

158s

Command Line

"C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

Signatures

RMS

trojan rat rms

UAC bypass

evasion trojan

Checks whether UAC is enabled

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\JavaSE\driversmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\driversmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\taskmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\regedit.reg C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\taskmgs.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\regedit.reg C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\vp8encoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\settings.ini C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\sys.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File created C:\Program Files\JavaSE\vp8decoder.dll C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\settings.ini C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
File opened for modification C:\Program Files\JavaSE\sys.exe C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotifyIcon.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotifyIcon.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132894043356936587" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4360" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4108" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "3.571185" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.081593" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "8.339222" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" C:\Windows\System32\svchost.exe N/A

Runs .reg file with regedit

Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A
N/A N/A C:\Windows\SysWOW64\regedit.exe N/A

Suspicious behavior: SetClipboardViewer

Description Indicator Process Target
N/A N/A C:\Program Files\JavaSE\driversmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\driversmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\driversmgs.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: 33 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeDebugPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeTcbPrivilege N/A C:\Program Files\JavaSE\taskmgs.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A
N/A N/A C:\Program Files\JavaSE\taskmgs.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3588 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 3748 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3144 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3632 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 3012 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\regedit.exe
PID 3588 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 3588 wrote to memory of 2208 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\taskmgs.exe
PID 1356 wrote to memory of 3492 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1356 wrote to memory of 3492 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1356 wrote to memory of 3492 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1356 wrote to memory of 3408 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1356 wrote to memory of 3408 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 1356 wrote to memory of 3408 N/A C:\Program Files\JavaSE\taskmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 3588 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 3588 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 3588 wrote to memory of 1948 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Program Files\JavaSE\sys.exe
PID 3588 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 3588 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 3588 wrote to memory of 3596 N/A C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe C:\Windows\SysWOW64\cmd.exe
PID 3408 wrote to memory of 3632 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 3408 wrote to memory of 3632 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe
PID 3408 wrote to memory of 3632 N/A C:\Program Files\JavaSE\driversmgs.exe C:\Program Files\JavaSE\driversmgs.exe

System policy modification

evasion
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableUIADesktopToggle = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe

"C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\Program Files\JavaSE\regedit.reg"

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /silentinstall

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /firewall

C:\Windows\SysWOW64\regedit.exe

regedit /s "C:\Program Files\JavaSE\regedit.reg"

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe" /start

C:\Program Files\JavaSE\taskmgs.exe

"C:\Program Files\JavaSE\taskmgs.exe"

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe"

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe" /tray

C:\Program Files\JavaSE\sys.exe

"C:\Program Files\JavaSE\sys.exe"

C:\Windows\system32\MusNotifyIcon.exe

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\929af602b5a11b1477d8e3843dcb9b9de1487c8ff5ebf6016f7dac96bf83d6a7.exe"

C:\Program Files\JavaSE\driversmgs.exe

"C:\Program Files\JavaSE\driversmgs.exe" /tray

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 72.21.91.29:80 tcp
US 8.8.8.8:53 rmansys.ru udp
RU 31.31.198.18:80 rmansys.ru tcp
RU 31.31.198.18:80 rmansys.ru tcp
US 8.8.8.8:53 rms-server.tektonit.ru udp
RU 95.213.205.83:5655 rms-server.tektonit.ru tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
US 52.143.81.222:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp

Files

memory/3588-130-0x0000000000400000-0x0000000000E30000-memory.dmp

C:\Program Files\JavaSE\regedit.reg

MD5 b6b4fd34f7a392985ad155c56ed73ffa
SHA1 2aeb0d7fcc1db7de8298645af6d502a89cdc25fe
SHA256 ac045b265f35608d6c41fae74503423bad9d10894fea9c147b5544004055f23b
SHA512 2bed3fb87ffaccba1ee739f89e950198d834e3b10a99daaf77bc5a3736d3554fbe1660c6313f5bccbc0291d2688d7c5d5d363f206feb0d2ecf86b599cf6bef23

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\taskmgs.exe

MD5 227288acd643d368b2be4f36b615d4fe
SHA1 afcf4b63b7e85f17b3c57f97b3f86ed3d7b043d4
SHA256 11dd02498854e5463dd2e04e1d6434c2b8efc0cc59a363a6f23754f2f6aff560
SHA512 eeb4b365da7b3ae9c8302ed6a5860bbc0501eb2ec548308c7938f16aefbc716c15492529bd524a77ac78eebd5ad8514377376177d3516da18658e2d674cfcb1d

C:\Program Files\JavaSE\vp8decoder.dll

MD5 d43fa82fab5337ce20ad14650085c5d9
SHA1 678aa092075ff65b6815ffc2d8fdc23af8425981
SHA256 c022958429edd94bfe31f2eacfe24ff6b45d6f12747725c449a36116373de03b
SHA512 103e61a9f58df03316676a074487e50ec518479c11068df3736df139b85c7671048c65bce0ef2c55b3c50c61fde54e9e6c7d1b795aea71263ae94c91d4874e0d

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

C:\Program Files\JavaSE\vp8encoder.dll

MD5 dab4646806dfca6d0e0b4d80fa9209d6
SHA1 8244dfe22ec2090eee89dad103e6b2002059d16a
SHA256 cb6ef96d3a66ef08ec2c8640b751a52d6d4f4530cf01162a69966f0fd5153587
SHA512 aa5eb93bf23a10de797d6fb52a55a95d36bc48927c76fedd81e0c48872745cb7f7d1b3f230eaae42fd4e79b6a59ca707e56bd6963b03644cbd5984f11e98d6e7

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

\??\PIPE\wkssvc

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Program Files\JavaSE\sys.exe

MD5 c1f5f8b110cce7f10277c630f242ac24
SHA1 6e7b88221816cba0a098bad6318b1fae6fc74ec6
SHA256 e65c571a758aa024f9c03b8367e3b6762b53f4ba4049f725a6d3cd79c6849dde
SHA512 7c9c777561a4eed10beee6598e3bcec593d7d5fd9e00460dc7635235056f81ab201a0fd5058aeda603580ab874c3d1183737b6a7e040b2985582e87c631eb560

C:\Program Files\JavaSE\sys.exe

MD5 c1f5f8b110cce7f10277c630f242ac24
SHA1 6e7b88221816cba0a098bad6318b1fae6fc74ec6
SHA256 e65c571a758aa024f9c03b8367e3b6762b53f4ba4049f725a6d3cd79c6849dde
SHA512 7c9c777561a4eed10beee6598e3bcec593d7d5fd9e00460dc7635235056f81ab201a0fd5058aeda603580ab874c3d1183737b6a7e040b2985582e87c631eb560

memory/1948-147-0x0000000000400000-0x000000000093355C-memory.dmp

memory/1948-148-0x0000000000400000-0x000000000093355C-memory.dmp

memory/3588-151-0x0000000000400000-0x0000000000E30000-memory.dmp

memory/1948-152-0x0000000000401000-0x0000000000742000-memory.dmp

memory/1948-154-0x0000000002980000-0x0000000002983000-memory.dmp

memory/1948-153-0x0000000002620000-0x0000000002946000-memory.dmp

memory/1948-155-0x0000000002970000-0x0000000002976000-memory.dmp

memory/3408-156-0x00000000009B5000-0x00000000009B6000-memory.dmp

memory/1356-157-0x00000000014F0000-0x00000000014F1000-memory.dmp

memory/3408-158-0x0000000000CC0000-0x0000000000CC1000-memory.dmp

memory/3492-159-0x0000000002750000-0x0000000002751000-memory.dmp

C:\Program Files\JavaSE\driversmgs.exe

MD5 66a09a782a266bc773c5cc89401e6c26
SHA1 537b04d591d69b933633ef22a1f89489ee9cd2d2
SHA256 18b1f86c11df7a60cc64695ba9f2af98851bcf155fa4c696d7f4a26b3805b51c
SHA512 9bae4f63d4af38f3194f6fe13e6543143b7e1ff7f76e0f9c2dd999fbc298d3965bcbbbe37838f4d5b97103a5595802ef0c3a4f3ed106f9a35d6c8b19ca17b4d6

memory/3632-161-0x0000000002760000-0x0000000002761000-memory.dmp