663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef

Analysis

max time kernel
169s
max time network
176s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
26-11-2022 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Size

3.9MB
MD5

fd27fec87ff61b77b815fc3d6b77a9c4
SHA1

9a250fa16fa7a00dfa01e1384d00d902df71fcd6
SHA256

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef
SHA512

f6f490ed00fcf460e25b77483b04fa8c452c91ddeeb0a64c434763e6f7d2df2d7eacd56727615cea9b37ed9a0ccf10fe81ce8992cbb80b4b02b0daecc71c1bfc
SSDEEP

98304:SyIyGXk/2gPQDUEJ7qw7P8fpmr5GPInWXh+nboj3aVA:myG0/2KyDH7kfpo5GrXh+nbY3v

Score

10^/10

bootkit evasion persistence spyware stealer themida trojan

Malware Config

Signatures

UAC bypass 3 TTPs 6 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Drops file in Drivers directory 5 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened for modification	C:\Windows\system32\drivers\etc\host_new	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File created	C:\Windows\system32\drivers\etc\host_new	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File created	C:\Windows\System32\drivers\etc\hosts	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nwservice.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\panixk.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pptbc.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Save.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\driverctrl.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\_avp32.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ppvstop.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sahagent.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fast.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rcsync.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trjscan.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vettray.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvwiz.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfgwiz.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpfsetup.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\espwatch.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wintsk32.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Anti-Virus Professional.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msdos.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intren.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npssvc.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rescue.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oaview.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan95.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autodown.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwinnt.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cfinet32.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lockdown.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbpoll.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kazza.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\deloeminfs.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmdagent.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AAWTray.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spyxx.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\trojantrap3.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpfw30s.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[4].exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashSkPcc.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\signcheck.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\expert.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\drweb32.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbcons.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windows Police Pro.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PskSvc.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkwctl9.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avpupd.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vir-help.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusXP	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\infus.exe\Debugger = "svchost.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\start.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashServ.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Wine	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Loads dropped DLL 4 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid	process
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Themida packer 8 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2000-56-0x0000000013140000-0x00000000138E3000-memory.dmp	themida
behavioral1/memory/2000-59-0x0000000013140000-0x00000000138E3000-memory.dmp	themida
behavioral1/memory/2000-60-0x0000000013140000-0x00000000138E3000-memory.dmp	themida
behavioral1/memory/2000-62-0x0000000013140000-0x00000000138E3000-memory.dmp	themida
behavioral1/memory/2000-63-0x0000000013140000-0x0000000013141000-memory.dmp	themida
behavioral1/memory/2000-64-0x0000000013140000-0x0000000013141000-memory.dmp	themida
behavioral1/memory/2000-65-0x0000000013140000-0x0000000013141000-memory.dmp	themida
behavioral1/memory/2000-76-0x0000000013140000-0x00000000138E3000-memory.dmp	themida

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Smart Security = "\"C:\\ProgramData\\2f461\\SM4bb.exe\" /s /d"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1063

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\ 663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Eset\Nod\	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Checks whether UAC is enabled 1 TTPs 3 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
File opened (read-only)	\??\M:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\P:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\Q:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\S:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\X:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\E:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\J:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\L:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\O:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\R:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\Z:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\G:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\N:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\T:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\U:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\Y:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\F:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\H:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\I:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\K:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\V:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
File opened (read-only)	\??\W:	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1067

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description ioc process

File opened for modification \??\PhysicalDrive0 663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid process

2000 663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	pid	process	target process
PID 1984 set thread context of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\IIL = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=302&q={searchTerms}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ltTST = "53863"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=302&q={searchTerms}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=302&q={searchTerms}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=302&q={searchTerms}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Modifies registry class 16 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Software	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Software\Microsoft	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Software\Microsoft\Internet Explorer	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.DocHostUIHandler	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=302&q={searchTerms}"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.DocHostUIHandler\ = "Implements DocHostUIHandler"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.DocHostUIHandler\Clsid	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.DocHostUIHandler"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid	process
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mofcomp.exe

description pid process

Token: SeSecurityPrivilege 1100 mofcomp.exe

description	pid	process
Token: SeSecurityPrivilege	1100	mofcomp.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid	process
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious use of SendNotifyMessage 2 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid	process
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

pid	process
1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	pid	process	target process
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 1984 wrote to memory of 2000	1984	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
PID 2000 wrote to memory of 1100	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	mofcomp.exe
PID 2000 wrote to memory of 1100	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	mofcomp.exe
PID 2000 wrote to memory of 1100	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	mofcomp.exe
PID 2000 wrote to memory of 1100	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	mofcomp.exe
PID 2000 wrote to memory of 1912	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	netsh.exe
PID 2000 wrote to memory of 1912	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	netsh.exe
PID 2000 wrote to memory of 1912	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	netsh.exe
PID 2000 wrote to memory of 1912	2000	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe	netsh.exe

System policy modification 1 TTPs 7 IoCs

evasion

Modify Registry

T1112

Processes:

663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "2"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "2"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "1"	663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe

C:\Users\Admin\AppData\Local\Temp\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
"C:\Users\Admin\AppData\Local\Temp\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1984

C:\Users\Admin\AppData\Local\Temp\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
C:\Users\Admin\AppData\Local\Temp\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe
2⤵
- UAC bypass
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Adds Run key to start application
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2000

C:\Windows\SysWOW64\wbem\mofcomp.exe
"C:\Windows\System32\wbem\mofcomp.exe" "C:\Users\Admin\AppData\Local\Temp\886.mof"
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1100

C:\Windows\SysWOW64\netsh.exe
"C:\Windows\System32\netsh.exe" "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef.exe" "Smart Security" ENABLE
3⤵
PID:1912

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Bootkit

T1067

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Security Software Discovery

T1063

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\886.mof
Filesize
326B

MD5
0546a7439cf725fbd2bfbd3ccda93c92

SHA1
ede39926dbeee95ca39425ed788fac64a7f30abf

SHA256
4cd9f90581e97b7b046f4afd67bf75afd8645dc883968ead4f9ae0f2e7ef7ec2

SHA512
c9fd85db8e7e9e09c6374d20a38dea35a937265c069784e08911f6db680094ab41df90e60aa5f66c51793748aa3f0730519bbde8dbe665d342c0310f9484cfe1

Download Submit
\ProgramData\2f461\SM4bb.exe
Filesize
3.9MB

MD5
fd27fec87ff61b77b815fc3d6b77a9c4

SHA1
9a250fa16fa7a00dfa01e1384d00d902df71fcd6

SHA256
663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef

SHA512
f6f490ed00fcf460e25b77483b04fa8c452c91ddeeb0a64c434763e6f7d2df2d7eacd56727615cea9b37ed9a0ccf10fe81ce8992cbb80b4b02b0daecc71c1bfc

Download Submit
\ProgramData\2f461\SM4bb.exe
Filesize
3.9MB

MD5
fd27fec87ff61b77b815fc3d6b77a9c4

SHA1
9a250fa16fa7a00dfa01e1384d00d902df71fcd6

SHA256
663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef

SHA512
f6f490ed00fcf460e25b77483b04fa8c452c91ddeeb0a64c434763e6f7d2df2d7eacd56727615cea9b37ed9a0ccf10fe81ce8992cbb80b4b02b0daecc71c1bfc

Download Submit
\ProgramData\2f461\SM4bb.exe
Filesize
3.9MB

MD5
fd27fec87ff61b77b815fc3d6b77a9c4

SHA1
9a250fa16fa7a00dfa01e1384d00d902df71fcd6

SHA256
663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef

SHA512
f6f490ed00fcf460e25b77483b04fa8c452c91ddeeb0a64c434763e6f7d2df2d7eacd56727615cea9b37ed9a0ccf10fe81ce8992cbb80b4b02b0daecc71c1bfc

Download Submit
\ProgramData\2f461\SM4bb.exe
Filesize
3.9MB

MD5
fd27fec87ff61b77b815fc3d6b77a9c4

SHA1
9a250fa16fa7a00dfa01e1384d00d902df71fcd6

SHA256
663698248f8b0e3ab5d58abe2a6fb2e7be21e4e4c4cf65693b7b3bbc6be7c1ef

SHA512
f6f490ed00fcf460e25b77483b04fa8c452c91ddeeb0a64c434763e6f7d2df2d7eacd56727615cea9b37ed9a0ccf10fe81ce8992cbb80b4b02b0daecc71c1bfc

Download Submit
memory/1100-68-0x0000000000000000-mapping.dmp

Download
memory/1912-69-0x0000000000000000-mapping.dmp

Download
memory/2000-61-0x0000000075571000-0x0000000075573000-memory.dmp

Filesize
8KB

Download
memory/2000-65-0x0000000013140000-0x0000000013141000-memory.dmp

Filesize
4KB

Download
memory/2000-66-0x0000000013141000-0x000000001325E000-memory.dmp

Filesize
1.1MB

Download
memory/2000-64-0x0000000013140000-0x0000000013141000-memory.dmp

Filesize
4KB

Download
memory/2000-63-0x0000000013140000-0x0000000013141000-memory.dmp

Filesize
4KB

Download
memory/2000-62-0x0000000013140000-0x00000000138E3000-memory.dmp

Filesize
7.6MB

Download
memory/2000-57-0x0000000013707014-mapping.dmp

Download
memory/2000-60-0x0000000013140000-0x00000000138E3000-memory.dmp

Filesize
7.6MB

Download
memory/2000-59-0x0000000013140000-0x00000000138E3000-memory.dmp

Filesize
7.6MB

Download
memory/2000-56-0x0000000013140000-0x00000000138E3000-memory.dmp

Filesize
7.6MB

Download
memory/2000-76-0x0000000013140000-0x00000000138E3000-memory.dmp

Filesize
7.6MB

Download