Analysis
-
max time kernel
75s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 14:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cdn.discordapp.com/attachments/667307564777734173/1038768226429059092/a.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
http://cdn.discordapp.com/attachments/667307564777734173/1038768226429059092/a.exe
Resource
win10v2004-20221111-en
General
-
Target
http://cdn.discordapp.com/attachments/667307564777734173/1038768226429059092/a.exe
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
a.exepid process 1508 a.exe -
Modifies Installed Components in the registry 2 TTPs 6 IoCs
Processes:
explorer.exeunregmp2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95} unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,7601,17514" unregmp2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP" unregmp2.exe -
Loads dropped DLL 4 IoCs
Processes:
iexplore.exeexplorer.exepid process 896 iexplore.exe 896 iexplore.exe 2272 explorer.exe 2272 explorer.exe -
Drops desktop.ini file(s) 8 IoCs
Processes:
unregmp2.exewmplayer.exedescription ioc process File opened for modification C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini unregmp2.exe File opened for modification C:\Users\Admin\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Music\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Videos\desktop.ini wmplayer.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini wmplayer.exe File opened for modification C:\Users\Public\Pictures\desktop.ini wmplayer.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
wmplayer.exedescription ioc process File opened (read-only) \??\G: wmplayer.exe File opened (read-only) \??\I: wmplayer.exe File opened (read-only) \??\L: wmplayer.exe File opened (read-only) \??\Q: wmplayer.exe File opened (read-only) \??\V: wmplayer.exe File opened (read-only) \??\Z: wmplayer.exe File opened (read-only) \??\E: wmplayer.exe File opened (read-only) \??\N: wmplayer.exe File opened (read-only) \??\R: wmplayer.exe File opened (read-only) \??\S: wmplayer.exe File opened (read-only) \??\W: wmplayer.exe File opened (read-only) \??\X: wmplayer.exe File opened (read-only) \??\F: wmplayer.exe File opened (read-only) \??\H: wmplayer.exe File opened (read-only) \??\J: wmplayer.exe File opened (read-only) \??\M: wmplayer.exe File opened (read-only) \??\O: wmplayer.exe File opened (read-only) \??\T: wmplayer.exe File opened (read-only) \??\B: wmplayer.exe File opened (read-only) \??\K: wmplayer.exe File opened (read-only) \??\P: wmplayer.exe File opened (read-only) \??\U: wmplayer.exe File opened (read-only) \??\Y: wmplayer.exe File opened (read-only) \??\A: wmplayer.exe -
Drops file in Program Files directory 1 IoCs
Processes:
unregmp2.exedescription ioc process File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe unregmp2.exe -
Drops file in Windows directory 2 IoCs
Processes:
explorer.exedescription ioc process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
chrome.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d0bf0c7b4fffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PhishingFilter iexplore.exe -
Processes:
iexplore.exerundll32.exeexplorer.exeIEXPLORE.EXEdescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000000000001000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TypedURLs rundll32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006bd7f4e5833efb45a119733006c3a4e300000000020000000000106600000001000020000000c7e280dada8cf917d8a603690e4a2d1a0fd45db27bb08ef1aeec8c21357f965b000000000e80000000020000200000003b5c1808c4a27e452355766085f279180df15b338af14df6489a85537972835c900000003723591639144fe75975b71244e51ca24b1808046814fbf062097cf536f368fb7b42256bf7f00793ecfacec34a5c4eba7b6bb944c7fe2b49263c845477f8fcec56848d0636c3f7aad7f5b9f22115ab28280ace7518929ebcd8803529bec495dbb559918b0bc4da0e420f2d3f37a72724a717acacd9633b44cebdab105fe36cd002d4d909ff68ee481cffb0fb4bd1986140000000423e0f74726262944e93f42aee26f2670bf90249a792f1f052488304fbecde33efa8b5403f6c1f35ab7bbebe8b7ba06952d26521e837d45803666c412ed9a751 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LinksExplorer\LinksType = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000006bd7f4e5833efb45a119733006c3a4e3000000000200000000001066000000010000200000001e4610f999924c3998d92ef600e9d4a0e5c7226843d6d0987d62d38e8f33ee2a000000000e80000000020000200000009c36702896e5dcf7bc2057836cbbb514a41201dd7002dc2ed33af143523518d920000000e3a29985ef3bd86d7cca037d7d4ae74a0df4725ef6fefbefefe60b876c0f9d294000000031c66b6ea644022066e36b0eab740814aa57766573b6fc084254ca45203e6631b3aa12a06cfa2ad53a51b79237d41448910199a587abb2a92847bc277782660f iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "375981956" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LinksExplorer\Width = "290" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{B2C08B51-6B42-11ED-A993-42FEA5F7B9B2} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LinksExplorer iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 3068298d4fffd801 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\NotifyDownloadComplete = "yes" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe -
Modifies registry class 64 IoCs
Processes:
unregmp2.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\WMPShopMusic unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867} unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\ = "&Add to Windows Media Player list" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF} unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\ = "&Play with Windows Media Player" unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\NeverDefault unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\NeverDefault unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}" unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command unregmp2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play unregmp2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\NeverDefault unregmp2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
chrome.exechrome.exepid process 1580 chrome.exe 732 chrome.exe 732 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
iexplore.exeexplorer.exepid process 896 iexplore.exe 2272 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEexplorer.exeSndVol.exedescription pid process Token: 33 2280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2280 AUDIODG.EXE Token: SeShutdownPrivilege 2272 explorer.exe Token: 33 2280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2280 AUDIODG.EXE Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: 33 1800 SndVol.exe Token: 33 1800 SndVol.exe Token: SeIncBasePriorityPrivilege 1800 SndVol.exe Token: SeIncBasePriorityPrivilege 1800 SndVol.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe Token: SeShutdownPrivilege 2272 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
iexplore.exeSndVol.exeexplorer.exechrome.exepid process 896 iexplore.exe 896 iexplore.exe 896 iexplore.exe 896 iexplore.exe 1800 SndVol.exe 1800 SndVol.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 896 iexplore.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 896 iexplore.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
SndVol.exeexplorer.exechrome.exepid process 1800 SndVol.exe 1800 SndVol.exe 1800 SndVol.exe 1800 SndVol.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe 732 chrome.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe 2272 explorer.exe -
Suspicious use of SetWindowsHookEx 13 IoCs
Processes:
iexplore.exeIEXPLORE.EXEexplorer.exepid process 896 iexplore.exe 896 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 896 iexplore.exe 896 iexplore.exe 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 1704 IEXPLORE.EXE 896 iexplore.exe 896 iexplore.exe 2272 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exewmplayer.exewmplayer.exesetup_wm.exechrome.exeSndVol.execontrol.exedescription pid process target process PID 896 wrote to memory of 1704 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1704 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1704 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1704 896 iexplore.exe IEXPLORE.EXE PID 896 wrote to memory of 1508 896 iexplore.exe a.exe PID 896 wrote to memory of 1508 896 iexplore.exe a.exe PID 896 wrote to memory of 1508 896 iexplore.exe a.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1092 wrote to memory of 776 1092 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 1552 wrote to memory of 564 1552 wmplayer.exe setup_wm.exe PID 564 wrote to memory of 540 564 setup_wm.exe iexplore.exe PID 564 wrote to memory of 540 564 setup_wm.exe iexplore.exe PID 564 wrote to memory of 540 564 setup_wm.exe iexplore.exe PID 564 wrote to memory of 540 564 setup_wm.exe iexplore.exe PID 732 wrote to memory of 816 732 chrome.exe chrome.exe PID 732 wrote to memory of 816 732 chrome.exe chrome.exe PID 732 wrote to memory of 816 732 chrome.exe chrome.exe PID 1800 wrote to memory of 2008 1800 SndVol.exe control.exe PID 1800 wrote to memory of 2008 1800 SndVol.exe control.exe PID 1800 wrote to memory of 2008 1800 SndVol.exe control.exe PID 2008 wrote to memory of 1612 2008 control.exe rundll32.exe PID 2008 wrote to memory of 1612 2008 control.exe rundll32.exe PID 2008 wrote to memory of 1612 2008 control.exe rundll32.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe PID 732 wrote to memory of 924 732 chrome.exe chrome.exe
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://cdn.discordapp.com/attachments/667307564777734173/1038768226429059092/a.exe1⤵
- Loads dropped DLL
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:896 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1704 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exe"2⤵
- Executes dropped EXE
PID:1508
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:11⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:12⤵PID:776
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:11⤵PID:612
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:11⤵
- Suspicious use of WriteProcessMemory
PID:1552 -
C:\Program Files (x86)\Windows Media Player\setup_wm.exe"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /prefetch:12⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://go.microsoft.com/fwlink/?linkid=1207223⤵PID:540
-
C:\Windows\SysWOW64\unregmp2.exeC:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary3⤵PID:2328
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT4⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
PID:2808 -
C:\Windows\SysWOW64\unregmp2.exe"C:\Windows\system32\unregmp2.exe" /PerformIndivIfNeeded3⤵PID:2804
-
C:\Windows\system32\unregmp2.exe"C:\Windows\SysNative\unregmp2.exe" /PerformIndivIfNeeded /REENTRANT4⤵PID:3032
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /prefetch:13⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:1540 -
C:\Program Files (x86)\Windows Media Player\wmpshare.exe"C:\Program Files (x86)\Windows Media Player\wmpshare.exe"4⤵PID:2788
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1156
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:2000
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6254f50,0x7fef6254f60,0x7fef6254f702⤵PID:816
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1136 /prefetch:22⤵PID:924
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1272 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1680 /prefetch:82⤵PID:2220
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2044 /prefetch:12⤵PID:2844
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2076 /prefetch:12⤵PID:2852
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2452 /prefetch:82⤵PID:3048
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3360 /prefetch:22⤵PID:552
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2696 /prefetch:12⤵PID:2388
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3456 /prefetch:82⤵PID:2496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3732 /prefetch:82⤵PID:2608
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3824 /prefetch:82⤵PID:2596
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1104,7894370837281401805,11361846664621540252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3920 /prefetch:82⤵PID:2792
-
C:\Windows\system32\SndVol.exeSndVol.exe -f 32178355 251691⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general2⤵
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general3⤵
- Modifies Internet Explorer settings
PID:1612 -
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general2⤵PID:1764
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general3⤵PID:2300
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general2⤵PID:2580
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general3⤵PID:2632
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general2⤵PID:2592
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general3⤵PID:2620
-
C:\Windows\System32\control.exe"C:\Windows\System32\control.exe" mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general2⤵PID:2692
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL mmsys.cpl,,{0.0.0.00000000}.{9d128519-a076-4f95-8ade-f750b800f857},general3⤵PID:2732
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Loads dropped DLL
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2272 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:2696
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:2836
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x49c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2280
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnkFilesize
1KB
MD5a926873e7a89ab80267515af8d91971a
SHA169e37329c8b44fc44611a1ec6386f5129c7f0087
SHA2563e6471e71253323ee859d3d2a41fbe51d0a1600ce0ca4f05e52863f9f7fa26b8
SHA51261172980a2ce767821669c185f6cbd882f32a1598f2fe24f224f3f26c0e443dc71c5fcafa6f0436d696b31ea6233b83d81c5bfd9d00acc8bae26d53ad97eb277
-
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.iniFilesize
964B
MD546a4eca2a791d84afecfd9f129a567df
SHA1004f2926d9377cc23c5b68ce26907435b8539643
SHA25606b6d34db7e9ebecc07e0b53fedb2a9bc2d4563b1d2037b7630fbc002942baf7
SHA512dbeecf882210add0dd4ac57f75ccdf6a9604c3308e92f70747313f89a7f9c590f4e1cdd507e53ee37e0a1b7e437320dc6ec1299d406ef34ddd67dfd900fddd98
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
61KB
MD53dcf580a93972319e82cafbc047d34d5
SHA18528d2a1363e5de77dc3b1142850e51ead0f4b6b
SHA25640810e31f1b69075c727e6d557f9614d5880112895ff6f4df1767e87ae5640d1
SHA51298384be7218340f95dae88d1cb865f23a0b4e12855beb6e74a3752274c9b4c601e493864db777bca677a370d0a9dbffd68d94898a82014537f3a801cce839c42
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
342B
MD5b6ca214bd6a410c94fe6dae16974487d
SHA19b9c05f0ea110e8c05268abcb72cf796899cb67c
SHA2561fc26d705b596fb587ef31517457d93d4609eea9e0368f3627ef2b544336e039
SHA5126eaed291f6bf5f51011e320523d4ec3a08ef48decb9a3d43bf71c6d747fae1f8640e33b53ea9e8e7fe2064294d57fbc7dbc7139d56eacc507ed3c56c066d3d5d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD52c7774323208737ff9c92c9957c5079b
SHA164696366ee0a800087e0b8fcd07dc1b7d17ffe2e
SHA25685b9beca3b2cb56de3c6e958f2df12513faad9600ca0214928b7b679948ef48e
SHA5122ce08a5ce5a37aa5103ef502cb2c3de319a1d904faafebb54278bcc4429cc787f03ab8299d75c72fdb870a85f316aa52981b9f16709bb74818c5547f762f3db8
-
C:\Users\Admin\AppData\Local\Microsoft\Media Player\CurrentDatabase_372.wmdbFilesize
1.0MB
MD550bdaf068f0d5e887c4b782f81010030
SHA1c3bd6da631c249fc38a256d046f431f8dced4249
SHA25688d2963d31f2b7b7ad4dc0fbebf0038e8763a24d0fce771027758a153fe65072
SHA51291a49f027dde421a2b73814422c069ce2aa8007ed41cf4a4d4989a80b8f688c0b306e3e550aad9fdf01e717702f20f1796117ab13c4d8accc063aa5baf5d73d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exeFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exe.vzftktt.partialFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
4KB
MD5116a9ae76ce5ea4739e3a6411255e638
SHA152123ec9dd06e51976c4f94dad769801e932d269
SHA256e5b67671cfe42e81a4b2bb5951ff4a31bc5ba3a975643e2f16591b7557534e4f
SHA51258abaea5638352003ef0c97cdb967bc1293debdfdb2bb7c7889e6b8e343ab5962f75baf6c3d8f5a297ad021e34e7d17ae8d9920249b0d42a4164d590308c904c
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
1KB
MD54c7bfeeea9f6fe7460cd8ba089d7c90f
SHA157fa781a7bf83448d6d0d41a7b9b54156c868f3f
SHA256ee63076aeec59d17f6e8dd7b343beef259f8806a06da9e8ff4932ba7364aafc1
SHA5126170b6735059dc3d3dd2ac4c2aaeb32ab67b0edf08de0ef3598384fcae8eac26139123083f336f2f8bfccfb309de962ff1bfa05df81463af224b974b23b19c9a
-
C:\Users\Admin\AppData\Local\Temp\wmsetup.logFilesize
3KB
MD5fb30ed5a6133d40a2e115d0dc72908aa
SHA1ced697274a4d90c9ee0a124c73779fe5af559d56
SHA2566d5af82ffd3cc00cd40bbe80ed61aa88ea258cbb97657c5fc21b74e0a3a12585
SHA5129f73828ae2632716d47e61aeb41c9414d0b109044e44de5072f9707acaf63db1d35dcc766bfc8e3a0aaaa848487728eec422b572baed09fc3f28f9e304f4c670
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\8198991E.txtFilesize
608B
MD5deaa9dc4e87739d24374cefb2cfabb94
SHA1978bd9bfb75914cefb2ffc1f3f9c7b0452fa3ab4
SHA2562f83065dd57d8a72fd2cf92de3ff53125f67dc46a0b47a2963f6869f97a0dd16
SHA51228ad7d84f3c7d73cde5f16823ef336657b7e2971ea536b33430dc24b8a8386661b87356086c7cc9b1d1dedfa84e6ed6032667e5a7556d48b60f1e50947d9e5e0
-
\??\pipe\crashpad_732_FXLDGJGITYBUFGZOMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exeFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exeFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exeFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\CASMTSF8\a.exeFilesize
2.5MB
MD5cb9619f658e595c2bea721cf9fe3cee4
SHA16051e6321438bcaef9b85c7280110c8299d8f108
SHA256da4280e70c5701f15bf235882e36409fca00d1030508f273e2a42cff5e9f1475
SHA5124af892f313349c91e76bbe42f9a539d545e798935ce7986fa36cb86d312c8ee650d83a474e1514688ef4d61d02899457790ed9cede5afdd86f4295fc8730dafd
-
memory/564-63-0x0000000000000000-mapping.dmp
-
memory/776-60-0x0000000000000000-mapping.dmp
-
memory/1092-59-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1156-66-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmpFilesize
8KB
-
memory/1508-57-0x0000000000000000-mapping.dmp
-
memory/1540-94-0x0000000000000000-mapping.dmp
-
memory/1612-71-0x0000000000000000-mapping.dmp
-
memory/1764-74-0x0000000000000000-mapping.dmp
-
memory/2008-69-0x0000000000000000-mapping.dmp
-
memory/2300-76-0x0000000000000000-mapping.dmp
-
memory/2328-87-0x0000000000000000-mapping.dmp
-
memory/2580-78-0x0000000000000000-mapping.dmp
-
memory/2592-79-0x0000000000000000-mapping.dmp
-
memory/2620-82-0x0000000000000000-mapping.dmp
-
memory/2632-83-0x0000000000000000-mapping.dmp
-
memory/2692-84-0x0000000000000000-mapping.dmp
-
memory/2696-110-0x0000000000000000-mapping.dmp
-
memory/2732-86-0x0000000000000000-mapping.dmp
-
memory/2788-108-0x0000000000000000-mapping.dmp
-
memory/2804-90-0x0000000000000000-mapping.dmp
-
memory/2808-89-0x0000000000000000-mapping.dmp
-
memory/2836-112-0x0000000000000000-mapping.dmp
-
memory/3032-92-0x0000000000000000-mapping.dmp
-
memory/3032-101-0x000007FEF4A00000-0x000007FEF4AD1000-memory.dmpFilesize
836KB
-
memory/3032-100-0x000007FEF4AE0000-0x000007FEF4C08000-memory.dmpFilesize
1.2MB
-
memory/3032-99-0x000007FEF4C10000-0x000007FEF4CD2000-memory.dmpFilesize
776KB