935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe

Processes:

e57036b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\6220ca97\ImagePath = "\\??\\C:\\Windows\\SysWOW64\\drivers\\6220ca97.sys"	e57036b.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

LivePOT.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation LivePOT.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	LivePOT.exe

Loads dropped DLL 21 IoCs

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exeLivePOT.exeLivePotUpdate.exe

pid	process
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
4940	LivePOT.exe
4940	LivePOT.exe
4940	LivePOT.exe
2064	LivePotUpdate.exe
2064	LivePotUpdate.exe
2064	LivePotUpdate.exe

Modifies file permissions 1 TTPs 4 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exe

pid process

212 takeown.exe
316 icacls.exe
2240 takeown.exe
4172 icacls.exe

pid	process
212	takeown.exe
316	icacls.exe
2240	takeown.exe
4172	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\LivePOTUpdater = "C:\\Program Files (x86)\\LivePOT\\LivePotBoot.exe"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

Browser Extensions

T1176

Processes:

e57036b.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	e57036b.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA}	e57036b.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	e57036b.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

e57036b.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	e57036b.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	e57036b.exe
Key value enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	e57036b.exe

Drops file in System32 directory 60 IoCs

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exee57036b.exesvchost.exe

description	ioc	process
File created	C:\Windows\SysWOW64\vkUserControlsXP.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\MSINET.OCX	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\scrrun.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\msimg32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\wininet.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\vbzlib1.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\INETKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\MSWINSCK.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\SCRRNKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\msvbvm60.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\MSFlxGrd.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File opened for modification	C:\Windows\SysWOW64\ws2tcpip.dll	e57036b.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{87BD9072-5E6B-4607-87BC-88E0D30013C2}.catalogItem	svchost.exe
File created	C:\Windows\SysWOW64\MSWINSCK.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\INETKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\GDIPLUS.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SCRRNKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\msvcrt.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\wshtcpip.dll	e57036b.exe
File created	C:\Windows\SysWOW64\stdole2.tlb	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\MSFlxGrd.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\comctl32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\vkUserControlsXP.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\vbzlib1.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\MSCOMCTL.OCX	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\FPSPR70.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\scrrun.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\asycfilt.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\olepro32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\urlmon.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\oleaut32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\GDIPLUS.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\comcat.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\asycfilt.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\WINSKKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\MSCOMCTL.OCX	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\MSINET.OCX	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\MSCMCKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\comctl32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\ws2tcpip.dll	e57036b.exe
File created	C:\Windows\SysWOW64\VB6KO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\olepro32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\msvbvm60.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\MSCMCKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\oleaut32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\FPSPR70.ocx	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\VB6STKIT.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\urlmon.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\winhttp.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\VB6STKIT.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\msimg32.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\midimap.dll	e57036b.exe
File created	C:\Windows\SysWOW64\SysWOW64\VB6KO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{0C72C2FB-3FE2-4266-8F6B-332D098F678C}.catalogItem	svchost.exe
File created	C:\Windows\SysWOW64\WINSKKO.DLL	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\wininet.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\msvcrt.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\winhttp.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\stdole2.tlb	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Windows\SysWOW64\SysWOW64\comcat.dll	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

Drops file in Program Files directory 8 IoCs

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

description	ioc	process
File created	C:\Program Files (x86)\LivePOT\LivePotBoot.exe	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\LivePOTAD.INI	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\LivePot.exe	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\ÀÌ¿ë¾à°ü.rtf	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\UpdateContents.txt	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\LivePotUpdate.exe	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\LivePotSetting.ini	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
File created	C:\Program Files (x86)\LivePOT\LivePotInfo.INI	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	nsis_installer_2

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe

Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exe

pid process

4848 schtasks.exe
4852 schtasks.exe

pid	process
4848	schtasks.exe
4852	schtasks.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

svchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe

Modifies Internet Explorer settings 1 TTPs 57 IoCs

adware spyware

Modify Registry

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}\AlternateCLSID = "{74DD2713-BA98-4D10-A16E-270BBEB9B555}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{C74190B6-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{95F0B3BE-E8AC-4995-9DCA-419849E06410}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}\AlternateCLSID = "{556C2772-F1AD-4DE1-8456-BD6E8F66113B}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\AlternateCLSID = "{A0E7BF67-8D30-4620-8825-7111714C7CAB}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\AlternateCLSID = "{9A948063-66C3-4F63-AB46-582EDAA35047}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{2C247F23-8591-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{24B224E0-9545-4A2F-ABD5-86AA8A849385}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{39977C62-C383-463D-AF61-C71220634656}\AlternateCLSID = "{6E5311A1-325D-4FFD-9AF4-B373F02AE458}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{35053A22-8589-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\AlternateCLSID = "{8B2ADD10-33B7-4506-9569-0A1E1DBBEBAE}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{66833FE6-8583-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1EFB6596-857C-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F91CAF91-225B-43A7-BB9E-472F991FC402}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{979127D3-7D01-4FDE-AF65-A698091468AF}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\AlternateCLSID = "{95F0B3BE-E8AC-4995-9DCA-419849E06410}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{DD9DA666-8594-11D1-B16A-00C0F0283628}\AlternateCLSID = "{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\Compatibility Flags = "1024"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{8E3867A3-8586-11D1-B16A-00C0F0283628}\AlternateCLSID = "{585AA280-ED8B-46B2-93AE-132ECFA1DAFC}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{996BF5E0-8044-4650-ADEB-0B013914E99C}\AlternateCLSID = "{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{F08DF954-8592-11D1-B16A-00C0F0283628}\AlternateCLSID = "{0B314611-2C19-4AB4-8513-A6EEA569D3C4}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{6262D3A0-531B-11CF-91F6-C2863C385E30}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

Modifies registry class 64 IoCs

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA664-8594-11D1-B16A-00C0F0283628}\TypeLib	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\TypeLib	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A64EBB2-5554-4AF1-8C73-F7D9DDC1E33D}\Implemented Categories	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{996BF5E0-8044-4650-ADEB-0B013914E99C}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX, 4"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Programmable	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\InprocServer32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\TypeLib	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InetCtls.Inet\CLSID\ = "{48E59293-9880-11CF-9754-00AA00C00908}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33297897-A3F3-48CB-A471-9ABDCECCB939}\TypeLib\ = "{D03BD7A6-46D2-4B8D-B126-DFE88C1FB240}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vkUserContolsXP.clsFastCollection\Clsid\ = "{4B602C9B-9374-499A-88ED-E9A80CDD5C71}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F9885E72-73AC-4DB1-AEF2-A54F2C137EF8}\VERSION\ = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ToolboxBitmap32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9181DC5F-E07D-418A-ACA6-8EEA1ECB8E9E}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8DFFA10E-27E4-436E-859F-2471E764C9A3}\TypeLib\Version = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AF681284-6D46-434F-9F2D-BB31314F9685}\VERSION\ = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F94EF446-425A-4484-B6C5-09A363FF7E8B}\ = "vkListBox"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D7126EF7-79C1-48FC-A8EB-FC8EE7FFFB99}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\ToolboxBitmap32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7DC6F291-BF55-4E50-B619-EF672D9DCC58}\MiscStatus\ = "0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CurVer	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8B1F9297-05C1-42C9-AB11-34C259F6FAB0}\VERSION	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9008EB16-773E-4978-B82D-C58A79F19602}\Implemented Categories	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{69310C27-4993-11D1-8905-0020AF131A57}\ = "IfpDataObject"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX, 10"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\CLSID\ = "{8E3867A3-8586-11D1-B16A-00C0F0283628}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0B314611-2C19-4AB4-8513-A6EEA569D3C4}\InprocServer32\ThreadingModel = "Apartment"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A46E53E3-E42E-45DE-BF36-9A888C43BA22}\InprocServer32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{627C8B79-918A-4C5C-9E19-20F66BF30B86}\VersionIndependentProgID\ = "MSComctlLib.SBarCtrl"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Version	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6319EEA0-531B-11CF-91F6-C2863C385E30}\ = "MSFlexGrid General Property Page Object"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0D9FD75A-CD10-471C-B09E-8CBF4051528E}\ProgID	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\vkUserContolsXP.vkBar\Clsid	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCDB0DF2-FD1A-4856-80BC-32929D8359B7}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{81E315A6-5F97-45DA-A34D-F536402DACBC}\TypeLib\Version = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2E632D9A-F74A-4340-B907-2489F8A85C5A}\TypeLib\Version = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4A519AE3-13ED-4966-ACBE-99ACA137E5B5}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9C3D2FDB-7C31-4AF5-9476-8560511349D4}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{556C2772-F1AD-4DE1-8456-BD6E8F66113B}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX, 3"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.SBarCtrl\CLSID	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{87DACC48-F1C5-4AF3-84BA-A2A72C2AB959}\Implemented Categories\{0DE86A52-2BAA-11CF-A229-00AA003D7352}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{74DD2713-BA98-4D10-A16E-270BBEB9B555}\Version\ = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7114683A-020D-4D16-80FD-6ACE384B66DF}\Version\ = "7.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWow64\\MSCOMCTL.OCX"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83FFE12D-0472-44EC-8BB1-6D4426A96286}\ProxyStubClsid32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\vkUserContolsXP.vkTextBox\Clsid\ = "{B97C6297-C1D3-4471-958D-183C4FCEF087}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\MiscStatus	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F25901D3-6AF2-41D7-B7FC-FCC359419CE9}\TypeLib\Version = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A46E53E3-E42E-45DE-BF36-9A888C43BA22}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{24B224E0-9545-4A2F-ABD5-86AA8A849385}\ToolboxBitmap32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F91CAF91-225B-43A7-BB9E-472F991FC402}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{609602E0-531B-11CF-91F6-C2863C385E30}\TypeLib\Version = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33297897-A3F3-48CB-A471-9ABDCECCB939}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F94EF446-425A-4484-B6C5-09A363FF7E8B}\ProxyStubClsid	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9008EB16-773E-4978-B82D-C58A79F19602}\VERSION\ = "1.0"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{556C2772-F1AD-4DE1-8456-BD6E8F66113B}\ProgID\ = "MSComctlLib.ImageListCtrl.2"	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

e57036b.exe935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe

pid	process
2656	e57036b.exe
2656	e57036b.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe
2656	e57036b.exe

Suspicious behavior: LoadsDriver 2 IoCs

Processes:

e57036b.exe

pid process

648
2656 e57036b.exe

pid	process
648
2656	e57036b.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

e57036b.exetakeown.exetakeown.exe

description	pid	process
Token: SeDebugPrivilege	2656	e57036b.exe
Token: SeTakeOwnershipPrivilege	2240	takeown.exe
Token: SeTakeOwnershipPrivilege	212	takeown.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

LivePOT.exeLivePotUpdate.exe

pid process

4940 LivePOT.exe
4940 LivePOT.exe
4940 LivePOT.exe
4940 LivePOT.exe
4940 LivePOT.exe
4940 LivePOT.exe
2064 LivePotUpdate.exe

pid	process
4940	LivePOT.exe
4940	LivePOT.exe
4940	LivePOT.exe
4940	LivePOT.exe
4940	LivePOT.exe
4940	LivePOT.exe
2064	LivePotUpdate.exe

Suspicious use of WriteProcessMemory 42 IoCs

Processes:

935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exee56fdbe.tmp935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exeLivePOT.exee57036b.execmd.execmd.exe

description	pid	process	target process
PID 1544 wrote to memory of 3084	1544	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	e56fdbe.tmp
PID 1544 wrote to memory of 3084	1544	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	e56fdbe.tmp
PID 1544 wrote to memory of 3084	1544	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	e56fdbe.tmp
PID 3084 wrote to memory of 2212	3084	e56fdbe.tmp	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
PID 3084 wrote to memory of 2212	3084	e56fdbe.tmp	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
PID 3084 wrote to memory of 2212	3084	e56fdbe.tmp	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
PID 3084 wrote to memory of 2656	3084	e56fdbe.tmp	e57036b.exe
PID 3084 wrote to memory of 2656	3084	e56fdbe.tmp	e57036b.exe
PID 3084 wrote to memory of 2656	3084	e56fdbe.tmp	e57036b.exe
PID 2212 wrote to memory of 4848	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4848	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4848	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4852	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4852	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4852	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	schtasks.exe
PID 2212 wrote to memory of 4940	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	LivePOT.exe
PID 2212 wrote to memory of 4940	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	LivePOT.exe
PID 2212 wrote to memory of 4940	2212	935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe	LivePOT.exe
PID 4940 wrote to memory of 2064	4940	LivePOT.exe	LivePotUpdate.exe
PID 4940 wrote to memory of 2064	4940	LivePOT.exe	LivePotUpdate.exe
PID 4940 wrote to memory of 2064	4940	LivePOT.exe	LivePotUpdate.exe
PID 2656 wrote to memory of 688	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 688	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 688	2656	e57036b.exe	cmd.exe
PID 688 wrote to memory of 2240	688	cmd.exe	takeown.exe
PID 688 wrote to memory of 2240	688	cmd.exe	takeown.exe
PID 688 wrote to memory of 2240	688	cmd.exe	takeown.exe
PID 688 wrote to memory of 4172	688	cmd.exe	icacls.exe
PID 688 wrote to memory of 4172	688	cmd.exe	icacls.exe
PID 688 wrote to memory of 4172	688	cmd.exe	icacls.exe
PID 2656 wrote to memory of 340	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 340	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 340	2656	e57036b.exe	cmd.exe
PID 340 wrote to memory of 212	340	cmd.exe	takeown.exe
PID 340 wrote to memory of 212	340	cmd.exe	takeown.exe
PID 340 wrote to memory of 212	340	cmd.exe	takeown.exe
PID 340 wrote to memory of 316	340	cmd.exe	icacls.exe
PID 340 wrote to memory of 316	340	cmd.exe	icacls.exe
PID 340 wrote to memory of 316	340	cmd.exe	icacls.exe
PID 2656 wrote to memory of 3564	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 3564	2656	e57036b.exe	cmd.exe
PID 2656 wrote to memory of 3564	2656	e57036b.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
"C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1544

C:\Users\Admin\AppData\Local\Temp\e56fdbe.tmp
>C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3084

C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe
"C:\Users\Admin\AppData\Local\Temp\935ab593fe53ee7261bc8e131db83ebd9b895714683e76fe8010f04018cba7fe.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2212

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn LivePOTUpdater /tr "'C:\Program Files (x86)\LivePOT\LivePotBoot.exe'" /sc onlogon /ru NT AUTHORITY\SYSTEM
4⤵
- Creates scheduled task(s)
PID:4848

C:\Windows\SysWOW64\schtasks.exe
schtasks /create /tn LivePOTUpdater /tr "'C:\Program Files (x86)\LivePOT\LivePotBoot.exe'" /sc onlogon /rl highest /f
4⤵
- Creates scheduled task(s)
PID:4852

C:\Program Files (x86)\LivePOT\LivePOT.exe
"C:\Program Files (x86)\LivePOT\LivePOT.exe"
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4940

C:\Program Files (x86)\LivePOT\LivePotUpdate.exe
"C:\Program Files (x86)\LivePOT\LivePotUpdate.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Users\Admin\AppData\Local\Temp\e57036b.exe
"C:\Users\Admin\AppData\Local\Temp\\e57036b.exe"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Sets service image path in registry
- Installs/modifies Browser Helper Object
- Maps connected drives based on registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2656

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\wshtcpip.dll && icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
4⤵
- Suspicious use of WriteProcessMemory
PID:688

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\wshtcpip.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:2240

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\wshtcpip.dll /grant administrators:F
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4172

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c takeown /f C:\Windows\SysWOW64\midimap.dll && icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
4⤵
- Suspicious use of WriteProcessMemory
PID:340

C:\Windows\SysWOW64\takeown.exe
takeown /f C:\Windows\SysWOW64\midimap.dll
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:212

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\SysWOW64\midimap.dll /grant administrators:F
5⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:316

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\ahnmove.bat
4⤵
PID:3564

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:1084

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Browser Extensions

T1176

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

File Permissions Modification

T1222

Credential Access

Discovery

Query Registry

System Information Discovery