e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f

System Information Discovery

Processes:

askToolbarInstaller-1.3.1.0.exeGLBA378.tmp

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	askToolbarInstaller-1.3.1.0.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	GLBA378.tmp

Loads dropped DLL 45 IoCs

Processes:

e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exeGLBA378.tmpMsiExec.exeIEXPLORE.EXEMsiExec.exe

pid	process
4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
3600	MsiExec.exe
4684	GLBA378.tmp
4684	GLBA378.tmp
3600	MsiExec.exe
3600	MsiExec.exe
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1540	MsiExec.exe
1540	MsiExec.exe
1540	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
1340	IEXPLORE.EXE

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sl1000 = "C:\\Users\\Admin\\AppData\\Local\\TempImages\\sl1000.exe"	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Drops file in System32 directory 1 IoCs

Processes:

GLBA378.tmp

description ioc process

File created C:\Windows\SysWOW64\GLBSINST.%$D GLBA378.tmp

description	ioc	process
File created	C:\Windows\SysWOW64\GLBSINST.%$D	GLBA378.tmp

Drops file in Program Files directory 17 IoCs

Processes:

GLBA378.tmpmsiexec.exe

description	ioc	process
File created	C:\Program Files (x86)\freevideomaster\~GLH0003.TMP	GLBA378.tmp
File created	C:\Program Files (x86)\Ask.com\config.xml	msiexec.exe
File opened for modification	C:\Program Files (x86)\freevideomaster\tbfree.dll	GLBA378.tmp
File created	C:\Program Files (x86)\Conduit\Community Alerts\~GLH0005.TMP	GLBA378.tmp
File created	C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll	msiexec.exe
File created	C:\Program Files (x86)\freevideomaster\~GLH0001.TMP	GLBA378.tmp
File opened for modification	C:\Program Files (x86)\freevideomaster\UNWISE.EXE	GLBA378.tmp
File created	C:\Program Files (x86)\freevideomaster\~GLH0002.TMP	GLBA378.tmp
File opened for modification	C:\Program Files (x86)\freevideomaster\toolbar.cfg	GLBA378.tmp
File opened for modification	C:\Program Files (x86)\freevideomaster\freevideomasterToolbarHelper.exe	GLBA378.tmp
File opened for modification	C:\Program Files (x86)\Conduit\Community Alerts\Alert.dll	GLBA378.tmp
File opened for modification	C:\Program Files (x86)\freevideomaster\INSTALL.LOG	GLBA378.tmp
File created	C:\Program Files (x86)\Ask.com\TaskScheduler.exe	msiexec.exe
File created	C:\Program Files (x86)\Ask.com\mupcfg.xml	msiexec.exe
File created	C:\Program Files (x86)\freevideomaster\~GLH0004.TMP	GLBA378.tmp
File created	C:\Program Files (x86)\freevideomaster\INSTALL.LOG	GLBA378.tmp
File created	C:\Program Files (x86)\Ask.com\UpdateTask.exe	msiexec.exe

Drops file in Windows directory 18 IoCs

Processes:

msiexec.exe

description	ioc	process
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBA9B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\ARPPRODUCTICON.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID686.tmp	msiexec.exe
File created	C:\Windows\Installer\e56b28c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC347.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID1A3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4ED.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\SourceHash{86D4B82A-ABED-442A-BE86-96357B70F4FE}	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC8A7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC9A2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID05A.tmp	msiexec.exe
File created	C:\Windows\Installer\e56b28f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e56b28c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6D5.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeGLBA378.tmpIEXPLORE.EXEe33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exeTaskScheduler.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\SearchScopes	GLBA378.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{afdbddaa-5d3f-42ee-b79c-185a7020515b}"	GLBA378.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001001a00000001000000000700005e0100000600000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004dd2df01eb737f498dfd7ea79365af4a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100003003600000001000000000700005e0100000600000001010000000000000700000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004dd2df01eb737f498dfd7ea79365af4a7f7c02d44a156640a1ad4243d812744000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\SearchUrl	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "92550754"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 903c2f0ca573d801	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce10000000002000000000010660000000100002000000070674a6b2b2520ce8a3c4fc65a99a91c4ed384755e67ed83f43dade54f9f8514000000000e8000000002000020000000cb82f6989f0a437c31a445ff8de5cdf2c134ab0149f81dba31cc9f78fd1625a32000000035696de86aa401a3cb1f515ba7ebdd5eb73b61e8b3465f31888f9c8db6a6d2f6400000005d92492a9d01fcae88c889bc37600296b8b0ac77d96c16769bccca6685846480132333a1a7f5fc403634f54f22b40df4ff6f9b80eccb2c216f8b4d622a13c5ad	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchUrl\ = "http://www.forumswatcher.com/search.htm"	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{afdbddaa-5d3f-42ee-b79c-185a7020515b}"	GLBA378.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}\URL = "http://supertoolbar.ask.com/redirect?client=ie&tb=SE&o=&src=crm&q={searchTerms}&locale={locale.underscore}"	TaskScheduler.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000000700005e010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A} = "freevideomaster Toolbar"	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\SearchScopes\{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}	TaskScheduler.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{171DEBEB-C3D4-40b7-AC73-056A5EBA4A7E}"	TaskScheduler.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "112551051"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000d44f7c908017924dbb36ebe98e677ce1000000000200000000001066000000010000200000009806b1bf0baf71d019ac6a1839c2da28b419ae8c877aaf8860b6847fbafcf46d000000000e800000000200002000000039de0619dae098a4bdb75ad9ea92f1edf1ca9fc0be1aa065925cbd86c74d73e5200000009ddb57a891fae05375b4e00d8da13c6da98b3333527c031d435147343ca98d55400000008faa1ec5dbc6eb38b46cc5e52eac29c488d8f54d9c64212e16cad34df1f220cfcbc888fdfaabb203ed4879d259e5a04da6df43e95483bedfa1f79c304798c562	iexplore.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	GLBA378.tmp
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{30B0FFD1-DF98-11EC-AD90-FEBD8A00EF86} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A} = 4dd2df01eb737f498dfd7ea79365af4a	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30962597"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\SuppressPerfBarUntil = 4e4acf276e74d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\URLSearchHooks\{01dfd24d-73eb-497f-8dfd-7ea79365af4a}	GLBA378.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\URL = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2239085"	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\MAO Settings\DiscardLoadTimes = a3c96f6a9050d801	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "26"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100001001a00000001000000000700005e0100000600000001010000000000000700000009010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004dd2df01eb737f498dfd7ea79365af4a7f7c02d44a156640a1ad4243d812744000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use Search Asst = "no"	GLBA378.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\{01dfd24d-73eb-497f-8dfd-7ea79365af4a}	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}	GLBA378.tmp
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Toolbar	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\SearchScopes	TaskScheduler.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3062550ca573d801	iexplore.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\DisplayName = "freevideomaster Customized Web Search"	GLBA378.tmp
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\DisplayName = "freevideomaster Customized Web Search"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{01dfd24d-73eb-497f-8dfd-7ea79365af4a} = "freevideomaster Toolbar"	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\MAO Settings	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\URLSearchHooks	GLBA378.tmp
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\URLSearchHooks	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\URL = "http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2239085"	GLBA378.tmp
Set value (data)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Layout = 13000000000000000000000020000000100003004d00000001000000000700005e0100000600000001010000000000000700000001010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004dd2df01eb737f498dfd7ea79365af4a7f7c02d44a156640a1ad4243d812744000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

Processes:

e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.forumswatcher.com/search.htm"	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\AskToolbar\Macro	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AskToolbar\Prefs	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\User Agent\Post Platform\AskTB{version}	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AskToolbar\Prefs\FreshInstall = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\AskToolbar	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\AskToolbar\Macro\revision = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	MsiExec.exe

Modifies registry class 64 IoCs

Processes:

GLBA378.tmpMsiExec.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A}\ = "freevideomaster Toolbar"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\InprocServer32\ThreadingModel = "Apartment"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd\CurVer\ = "GenericAskToolbar.ToolbarWnd.1"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A}\InprocServer32	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\ = "freevideomaster Findbar"	GLBA378.tmp
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\ = "IAskToolbar"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\ProductIcon = "C:\\Windows\\Installer\\{86D4B82A-ABED-442A-BE86-96357B70F4FE}\\ARPPRODUCTICON.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF\SuperToolbarIE	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\ProductName = "Ask Toolbar"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\A28B4D68DEBAA244EB686953B7074FEF\SuperToolbarFF = "\x06"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}\ = "GenericAskToolbar"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0\FLAGS	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd\CLSID\ = "{D4027C7F-154A-4066-A1AD-4243D8127440}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd.1	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd\CLSID	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\ProxyStubClsid32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\DeploymentFlags = "2"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\Programmable	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0\FLAGS\ = "0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\InprocServer32	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3c471948-f874-49f5-b338-4f214a2ee0b1}\InprocServer32\ThreadingModel = "Apartment"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ProgID\ = "GenericAskToolbar.ToolbarWnd.1"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\F928123A039649549966D4C29D35B1C9\A28B4D68DEBAA244EB686953B7074FEF	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GenericAskToolbar.ToolbarWnd\ = "ToolbarWnd Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\TypeLib\ = "{2996F0E7-292B-4CAE-893F-47B8B1C05B56}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{9B0CB95C-933A-4B8C-B6D4-EDCD19A43874}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\ = "IAskButton"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\Implemented Categories\{00021494-0000-0000-C000-000000000046}	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0\ = "GenericAskToolbar 1.0 Type Library"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\TypeLib\ = "{2996F0E7-292B-4CAE-893F-47B8B1C05B56}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{2996F0E7-292B-4CAE-893F-47B8B1C05B56}\1.0\0\win32\ = "C:\\Program Files (x86)\\Ask.com\\GenericAskToolbar.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A}	GLBA378.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\Implemented Categories	GLBA378.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\GenericAskToolbar.DLL	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8452CB0A-6B2B-42CB-B901-07E88AFCFF7C}\InprocServer32\ = "C:\\Program Files (x86)\\freevideomaster\\tbfree.dll"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{01DFD24D-73EB-497F-8DFD-7EA79365AF4A}\InprocServer32\ = "C:\\Program Files (x86)\\freevideomaster\\tbfree.dll"	GLBA378.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\InprocServer32\ThreadingModel = "Apartment"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\TypeLib\ = "{2996F0E7-292B-4CAE-893F-47B8B1C05B56}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\{3F6CFC8C-5304-45CA-ACB9-D0D4F176923A}\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\TypeLib	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\A28B4D68DEBAA244EB686953B7074FEF\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AC71B60E-94C9-4EDE-BA46-E146747BB67E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\ = "IAskButton"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91CF619A-4686-4CA4-9232-3B2E6B63AA92}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msiexec.exemsedge.exemsedge.exe

pid process

4088 msiexec.exe
4088 msiexec.exe
2404 msedge.exe
2404 msedge.exe
4032 msedge.exe
4032 msedge.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

iexplore.exe

pid process

656 iexplore.exe

pid	process
4088	msiexec.exe
4088	msiexec.exe
2404	msedge.exe
2404	msedge.exe
4032	msedge.exe
4032	msedge.exe

pid	process
656	iexplore.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

MSIEXEC.EXEmsiexec.exe

description	pid	process
Token: SeShutdownPrivilege	2260	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2260	MSIEXEC.EXE
Token: SeSecurityPrivilege	4088	msiexec.exe
Token: SeCreateTokenPrivilege	2260	MSIEXEC.EXE
Token: SeAssignPrimaryTokenPrivilege	2260	MSIEXEC.EXE
Token: SeLockMemoryPrivilege	2260	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	2260	MSIEXEC.EXE
Token: SeMachineAccountPrivilege	2260	MSIEXEC.EXE
Token: SeTcbPrivilege	2260	MSIEXEC.EXE
Token: SeSecurityPrivilege	2260	MSIEXEC.EXE
Token: SeTakeOwnershipPrivilege	2260	MSIEXEC.EXE
Token: SeLoadDriverPrivilege	2260	MSIEXEC.EXE
Token: SeSystemProfilePrivilege	2260	MSIEXEC.EXE
Token: SeSystemtimePrivilege	2260	MSIEXEC.EXE
Token: SeProfSingleProcessPrivilege	2260	MSIEXEC.EXE
Token: SeIncBasePriorityPrivilege	2260	MSIEXEC.EXE
Token: SeCreatePagefilePrivilege	2260	MSIEXEC.EXE
Token: SeCreatePermanentPrivilege	2260	MSIEXEC.EXE
Token: SeBackupPrivilege	2260	MSIEXEC.EXE
Token: SeRestorePrivilege	2260	MSIEXEC.EXE
Token: SeShutdownPrivilege	2260	MSIEXEC.EXE
Token: SeDebugPrivilege	2260	MSIEXEC.EXE
Token: SeAuditPrivilege	2260	MSIEXEC.EXE
Token: SeSystemEnvironmentPrivilege	2260	MSIEXEC.EXE
Token: SeChangeNotifyPrivilege	2260	MSIEXEC.EXE
Token: SeRemoteShutdownPrivilege	2260	MSIEXEC.EXE
Token: SeUndockPrivilege	2260	MSIEXEC.EXE
Token: SeSyncAgentPrivilege	2260	MSIEXEC.EXE
Token: SeEnableDelegationPrivilege	2260	MSIEXEC.EXE
Token: SeManageVolumePrivilege	2260	MSIEXEC.EXE
Token: SeImpersonatePrivilege	2260	MSIEXEC.EXE
Token: SeCreateGlobalPrivilege	2260	MSIEXEC.EXE
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe
Token: SeRestorePrivilege	4088	msiexec.exe
Token: SeTakeOwnershipPrivilege	4088	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

GLBA378.tmp

pid	process
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

GLBA378.tmp

pid	process
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp
4684	GLBA378.tmp

Suspicious use of SetWindowsHookEx 24 IoCs

Processes:

sl1000.exeCheckNewVersion.exeCheckLastVer.exeNEWA29E.tmp.exeiexplore.exeIEXPLORE.EXE

pid	process
2104	sl1000.exe
2104	sl1000.exe
4612	CheckNewVersion.exe
4940	CheckLastVer.exe
4940	CheckLastVer.exe
4612	CheckNewVersion.exe
2104	sl1000.exe
2104	sl1000.exe
1296	NEWA29E.tmp.exe
656	iexplore.exe
656	iexplore.exe
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE
1340	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exeFMS.exeaskToolbarInstaller-1.3.1.0.exeNEWA29E.tmp.exemsiexec.exeGLBA378.tmpiexplore.exeIEXPLORE.EXEie_to_edge_stub.exemsedge.exe

description	pid	process	target process
PID 4840 wrote to memory of 2792	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	askToolbarInstaller-1.3.1.0.exe
PID 4840 wrote to memory of 2792	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	askToolbarInstaller-1.3.1.0.exe
PID 4840 wrote to memory of 2792	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	askToolbarInstaller-1.3.1.0.exe
PID 4840 wrote to memory of 2104	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	sl1000.exe
PID 4840 wrote to memory of 2104	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	sl1000.exe
PID 4840 wrote to memory of 2104	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	sl1000.exe
PID 4840 wrote to memory of 4708	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	FMS.exe
PID 4840 wrote to memory of 4708	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	FMS.exe
PID 4840 wrote to memory of 4708	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	FMS.exe
PID 4840 wrote to memory of 4612	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckNewVersion.exe
PID 4840 wrote to memory of 4612	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckNewVersion.exe
PID 4840 wrote to memory of 4612	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckNewVersion.exe
PID 4840 wrote to memory of 4940	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckLastVer.exe
PID 4840 wrote to memory of 4940	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckLastVer.exe
PID 4840 wrote to memory of 4940	4840	e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe	CheckLastVer.exe
PID 4708 wrote to memory of 4684	4708	FMS.exe	GLBA378.tmp
PID 4708 wrote to memory of 4684	4708	FMS.exe	GLBA378.tmp
PID 4708 wrote to memory of 4684	4708	FMS.exe	GLBA378.tmp
PID 2792 wrote to memory of 1296	2792	askToolbarInstaller-1.3.1.0.exe	NEWA29E.tmp.exe
PID 2792 wrote to memory of 1296	2792	askToolbarInstaller-1.3.1.0.exe	NEWA29E.tmp.exe
PID 2792 wrote to memory of 1296	2792	askToolbarInstaller-1.3.1.0.exe	NEWA29E.tmp.exe
PID 1296 wrote to memory of 2260	1296	NEWA29E.tmp.exe	MSIEXEC.EXE
PID 1296 wrote to memory of 2260	1296	NEWA29E.tmp.exe	MSIEXEC.EXE
PID 1296 wrote to memory of 2260	1296	NEWA29E.tmp.exe	MSIEXEC.EXE
PID 4088 wrote to memory of 3600	4088	msiexec.exe	MsiExec.exe
PID 4088 wrote to memory of 3600	4088	msiexec.exe	MsiExec.exe
PID 4088 wrote to memory of 3600	4088	msiexec.exe	MsiExec.exe
PID 4684 wrote to memory of 656	4684	GLBA378.tmp	iexplore.exe
PID 4684 wrote to memory of 656	4684	GLBA378.tmp	iexplore.exe
PID 656 wrote to memory of 1340	656	iexplore.exe	IEXPLORE.EXE
PID 656 wrote to memory of 1340	656	iexplore.exe	IEXPLORE.EXE
PID 656 wrote to memory of 1340	656	iexplore.exe	IEXPLORE.EXE
PID 4088 wrote to memory of 2172	4088	msiexec.exe	MSIC347.tmp
PID 4088 wrote to memory of 2172	4088	msiexec.exe	MSIC347.tmp
PID 4088 wrote to memory of 2172	4088	msiexec.exe	MSIC347.tmp
PID 4088 wrote to memory of 1540	4088	msiexec.exe	MsiExec.exe
PID 4088 wrote to memory of 1540	4088	msiexec.exe	MsiExec.exe
PID 4088 wrote to memory of 1540	4088	msiexec.exe	MsiExec.exe
PID 4088 wrote to memory of 2980	4088	msiexec.exe	TaskScheduler.exe
PID 4088 wrote to memory of 2980	4088	msiexec.exe	TaskScheduler.exe
PID 4088 wrote to memory of 2980	4088	msiexec.exe	TaskScheduler.exe
PID 1340 wrote to memory of 5040	1340	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 1340 wrote to memory of 5040	1340	IEXPLORE.EXE	ie_to_edge_stub.exe
PID 5040 wrote to memory of 2404	5040	ie_to_edge_stub.exe	msedge.exe
PID 5040 wrote to memory of 2404	5040	ie_to_edge_stub.exe	msedge.exe
PID 2404 wrote to memory of 440	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 440	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe
PID 2404 wrote to memory of 1408	2404	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe
"C:\Users\Admin\AppData\Local\Temp\e33ab133c8bf41eb74b559fd7a10e46c12e7526100a229c11881bb66fcbf765f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\TempImages\askToolbarInstaller-1.3.1.0.exe
  C:\Users\Admin\AppData\Local\TempImages\askToolbarInstaller-1.3.1.0.exe /verysilent /sa /tbr toolbar=SE
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:2792
- - C:\Users\Admin\AppData\Local\Temp\NEWA29E.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\NEWA29E.tmp.exe" /s /v"PARTNER=SE HPR=NO /qn"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Temp\{3F6CFC8C-5304-45CA-ACB9-D0D4F176923A}\Ask Toolbar.msi" /L*vx C:\Users\Admin\AppData\Local\Temp\ASKSUTBLOG PARTNER=SE HPR=NO /qn SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="NEWA29E.tmp.exe"
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:2260
- C:\Users\Admin\AppData\Local\TempImages\sl1000.exe
  C:\Users\Admin\AppData\Local\TempImages\sl1000.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2104
- C:\Users\Admin\AppData\Local\TempImages\FMS.exe
  C:\Users\Admin\AppData\Local\TempImages\FMS.exe /s –silent -DefaultSearch=TRUE
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\GLBA378.tmp
    C:\Users\Admin\AppData\Local\Temp\GLBA378.tmp /s –silent -DefaultSearch=TRUE4736 C:\Users\Admin\AppData\Local\TEMPIM~1\FMS.exe
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Loads dropped DLL
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\PROGRA~1\INTERN~1\iexplore.exe
      "C:\PROGRA~1\INTERN~1\iexplore.exe" http://freevideomaster.OurToolbar.com/SetupFinish
      4⤵
      Modifies Internet Explorer settings
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:656
    - - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:656 CREDAT:17410 /prefetch:2
        5⤵
        Loads dropped DLL
        Modifies Internet Explorer settings
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1340
      - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\BHO\ie_to_edge_stub.exe" --from-ie-to-edge=3 --ie-frame-hwnd=102e4
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:5040
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --from-ie-to-edge=3 --ie-frame-hwnd=102e4
        7⤵
        Adds Run key to start application
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2404
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff961f146f8,0x7ff961f14708,0x7ff961f14718
        8⤵
        
        PID:440
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,12243827906394269409,8196879715488537942,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
        8⤵
        
        PID:1408
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,12243827906394269409,8196879715488537942,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
        8⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:4032
        
        C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,12243827906394269409,8196879715488537942,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
        8⤵
        
        PID:1516
- C:\Users\Admin\AppData\Local\TempImages\CheckLastVer.exe
  C:\Users\Admin\AppData\Local\TempImages\CheckLastVer.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4940
- C:\Users\Admin\AppData\Local\TempImages\CheckNewVersion.exe
  C:\Users\Admin\AppData\Local\TempImages\CheckNewVersion.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4612

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 846C227319D04E0ED1DD86675DA80C42
  2⤵
  - Loads dropped DLL
  PID:3600
- C:\Windows\Installer\MSIC347.tmp
  "C:\Windows\Installer\MSIC347.tmp"
  2⤵
  - Executes dropped EXE
  PID:2172
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 648BD94A42D3E7192B8683F91D21E324 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  - Modifies registry class
  PID:1540
- C:\Program Files (x86)\Ask.com\TaskScheduler.exe
  "C:\Program Files (x86)\Ask.com\TaskScheduler.exe" C:\Program Files (x86)\Ask.com\UpdateTask.exe
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery