edd2dca39f2c16c0e5ac08a905d4420759c32a2da3d254396940e9eee3480696

General

Target

InternetDownloadManagerPortable.exe
Size

71KB
MD5

1d9b7bb85e74cabafaac8baf2fc3db99
SHA1

c14e9a55a308b92bc4631e8aed3a24d34801bebc
SHA256

c1dbfcd749baa5a588e5ecc9cd05c14b6d224b7c0867117c519f9f1ea13811e0
SHA512

2a433f0ff84ba48676957ddc253df4d26d1c17b95f6928320758758af91bf6e85e31112b1370ce9d5d2768689998be915b3879b421266ff3deb5cc1267eb2099
SSDEEP

1536:YdnREfs9ke7FggdycW64fUX808MRwadzJaAwo+zo:YdRGsvFggQcWhcX8swa94Awo+zo

Score

8^/10

adware persistence stealer

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

RUNDLL32.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\DRIVERS\SETF33E.tmp	RUNDLL32.EXE
File created	C:\Windows\system32\DRIVERS\SETF33E.tmp	RUNDLL32.EXE
File opened for modification	C:\Windows\system32\DRIVERS\idmwfp.sys	RUNDLL32.EXE

Registers COM server for autorun 1 TTPs 58 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exeIDMIntegrator64.exeregsvr32.exeregsvr32.exeregsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMGetAll64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMShellExt64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMShellExt64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMGetAll64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\InprocServer32	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\InprocServer32	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDC95B92-E27C-4745-A8C5-64A52A78855D}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMShellExt64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	IDMIntegrator64.exe

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

InternetDownloadManagerPortable.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\IDMWFP\ImagePath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\idmwfp64.sys"	InternetDownloadManagerPortable.exe

Loads dropped DLL 2 IoCs

Processes:

InternetDownloadManagerPortable.exe

pid process

1792 InternetDownloadManagerPortable.exe
1792 InternetDownloadManagerPortable.exe
Adds Run key to start application 2 TTPs 1 IoCs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Processes:

RUNDLL32.EXE

description ioc process

Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o" RUNDLL32.EXE

pid	process
1792	InternetDownloadManagerPortable.exe
1792	InternetDownloadManagerPortable.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

IDMan.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\NoExplorer = "1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ = "IDM Helper"	IDMan.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exerunonce.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Modifies Internet Explorer settings 1 TTPs 24 IoCs

adware spyware

Modify Registry

T1112

Processes:

IDMan.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppName = "IDMan.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppName = "IEMonitor.exe"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать с помощью IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IEExt.htm"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать с помощью IDM\contexts = "243"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать все ссылки с помощью IDM\contexts = "243"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\AppPath = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DownloadUI = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать все ссылки с помощью IDM	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать все ссылки с помощью IDM\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IEGetAll.htm"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Low Rights	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E0DACC63-037F-46EE-AC02-E4C7B0FBFEB4}\Policy = "3"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1902485B-CE75-42C1-BA2D-57E660793D9A}\Policy = "3"	IDMan.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\AppName = "IDMan.exe"	IDMan.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Low Rights\DragDrop\{19129CDA-AFC0-4330-99BC-C5A834F89006}\Policy = "3"	IDMan.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Скачать с помощью IDM	IDMan.exe

Modifies registry class 64 IoCs

Processes:

IDMIntegrator64.exeregsvr32.exeInternetDownloadManagerPortable.exeIDMan.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\CLSID\ = "{4764030F-2733-45B9-AE62-3D1F4F6F2861}"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\ProgID\ = "DownlWithIDM.V2LinkProcessor.1"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMGetAll.IDMAllLinksProcessor\ = "IDMAllLinksProcessor Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{ECF21EAB-3AA8-4355-82BE-F777990001DD}\1.0	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor.1\ = "LinkProcessor Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37294E01-DB54-43AF-9D50-93FF7267DF5D}\1.0\HELPDIR	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{33AEF752-FB86-4787-9ED1-6010528F5FA3}	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{98D060EC-53AF-4F61-8180-43C507C9FF94}\ProxyStubClsid32	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BC69364C-34D7-4225-B16F-8595C743C775}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}	InternetDownloadManagerPortable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\InProcServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\idmfsa.dll"	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\TypeLib	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.IDMDwnlMgr\CLSID\ = "{7D11E719-FF90-479C-B0D7-96EB43EE55D7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4BD46AAE-C51F-4BF7-8BC0-2E86E33D1873}\ProxyStubClsid32	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ProgID	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor\ = "LinkProcessor Class"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\InprocServer32\ThreadingModel = "Apartment"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{5518B636-6884-48CA-A9A7-1CFD3F3BA916}\1.0\ = "idmfsa 1.0 Type Library"	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor.1\CLSID	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\InProcServer32\ThreadingModel = "Both"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0F947660-8606-420A-BAC6-51B84DD22A47}\AppId = "{0F947660-8606-420A-BAC6-51B84DD22A47}"	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\ProxyStubClsid32	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{356E6235-B055-46D9-8B32-BDC2266C9DAB}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Idmfsa.IDMEFSAgent.1\ = "IDMEFSAgent Class"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\ProgID\ = "DownlWithIDM.LinkProcessor.1"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\VersionIndependentProgID\ = "DownlWithIDM.LinkProcessor"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6B9EB066-DA1F-4C0A-AC62-01AC892EF175}	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{33AEF752-FB86-4787-9ED1-6010528F5FA3}\TypeLib	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Insertable	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor\ = "V2LinkProcessor Class"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5312C54E-A385-46B7-B200-ABAF81B03935}\ = "IDMAllLinksProcessor Class"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A89524B-E1B6-4D71-972A-8FD53F240936}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\downlWithIDM64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.V2LinkProcessor.1\CLSID\ = "{4764030F-2733-45B9-AE62-3D1F4F6F2861}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\TypeLib\ = "{6A89524B-E1B6-4D71-972A-8FD53F240936}"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IDMIECC.IDMIEHlprObj\CurVer\ = "IDMIECC.IDMIEHlprObj.1"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{436D67E1-2FB3-4A6C-B3CD-FF8A41B0664D}\ProgID\ = "IDMIECC.IDMHelperLinksStorage.1"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52F6F7BD-DF73-44B3-AE13-89E1E1FB8F6A}\Control	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{72B7361C-3568-4392-BCCD-D912CD5C1169}\ProxyStubClsid32	IDMan.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BC69364C-34D7-4225-B16F-8595C743C775}\ = "IVLinkProcessor"	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\ProxyStubClsid32\ = "{C950922F-897A-4E13-BA38-66C8AF2E0BF7}"	InternetDownloadManagerPortable.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{37294E01-DB54-43AF-9D50-93FF7267DF5D}\1.0\0	IDMan.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\ = "V2LinkProcessor Class"	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28670AE0-CAF4-4836-8418-0F456023EBF7}\NumMethods	InternetDownloadManagerPortable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A87AB5DD-211B-4284-8CBD-B92F77A5DE14}\TypeLib\ = "{5518B636-6884-48CA-A9A7-1CFD3F3BA916}"	InternetDownloadManagerPortable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{98D060EC-53AF-4F61-8180-43C507C9FF94}\TypeLib\ = "{3BDFC55C-ED33-43BB-9A77-57C2AF4B56EF}"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0055C089-8582-441B-A0BF-17B458C2A3A8}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C950922F-897A-4E13-BA38-66C8AF2E0BF7}\NumMethods	InternetDownloadManagerPortable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC746233-E9D3-49CD-862F-068F7B7CCCA4}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMan.exe"	IDMan.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CDD67718-A430-4AB9-A939-83D9074B0038}\VersionIndependentProgID	IDMIntegrator64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4764030F-2733-45B9-AE62-3D1F4F6F2861}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BDFC55C-ED33-43BB-9A77-57C2AF4B56EF}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\App\\IDM\\IDMIECC64.dll"	IDMIntegrator64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlWithIDM.LinkProcessor\CurVer\ = "DownlWithIDM.LinkProcessor.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7D11E719-FF90-479C-B0D7-96EB43EE55D7}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EDC7F8E-EB3D-4F9A-B693-216F07C94D74}\ = "IIDMEFSAgent"	InternetDownloadManagerPortable.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{6A89524B-E1B6-4D71-972A-8FD53F240936}\1.0\FLAGS\ = "0"	IDMan.exe

Runs net.exe
Suspicious behavior: LoadsDriver 6 IoCs

Processes:

pid process

652
652
652
652
652
652
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

firefox.exe

description pid process

Token: SeDebugPrivilege 2524 firefox.exe
Token: SeDebugPrivilege 2524 firefox.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

firefox.exeIDMan.exe

pid process

2524 firefox.exe
2524 firefox.exe
2524 firefox.exe
2524 firefox.exe
2040 IDMan.exe
Suspicious use of SendNotifyMessage 4 IoCs

Processes:

firefox.exeIDMan.exe

pid process

2524 firefox.exe
2524 firefox.exe
2524 firefox.exe
2040 IDMan.exe

pid	process
652
652
652
652
652
652

description	pid	process
Token: SeDebugPrivilege	2524	firefox.exe
Token: SeDebugPrivilege	2524	firefox.exe

pid	process
2524	firefox.exe
2524	firefox.exe
2524	firefox.exe
2524	firefox.exe
2040	IDMan.exe

pid	process
2524	firefox.exe
2524	firefox.exe
2524	firefox.exe
2040	IDMan.exe

Suspicious use of SetWindowsHookEx 13 IoCs

Processes:

IDMan.exeIDMIntegrator64.exeUninstall.exefirefox.exe

pid	process
2040	IDMan.exe
2040	IDMan.exe
2040	IDMan.exe
3268	IDMIntegrator64.exe
3268	IDMIntegrator64.exe
4592	Uninstall.exe
2524	firefox.exe
2040	IDMan.exe
2040	IDMan.exe
2040	IDMan.exe
2040	IDMan.exe
2040	IDMan.exe
2040	IDMan.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

InternetDownloadManagerPortable.exeIDMan.exefirefox.exeUninstall.exeRUNDLL32.EXErunonce.exefirefox.exenet.exenet.exe

description	pid	process	target process
PID 1792 wrote to memory of 2040	1792	InternetDownloadManagerPortable.exe	IDMan.exe
PID 1792 wrote to memory of 2040	1792	InternetDownloadManagerPortable.exe	IDMan.exe
PID 1792 wrote to memory of 2040	1792	InternetDownloadManagerPortable.exe	IDMan.exe
PID 2040 wrote to memory of 3268	2040	IDMan.exe	IDMIntegrator64.exe
PID 2040 wrote to memory of 3268	2040	IDMan.exe	IDMIntegrator64.exe
PID 2040 wrote to memory of 1156	2040	IDMan.exe	firefox.exe
PID 2040 wrote to memory of 1156	2040	IDMan.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 1156 wrote to memory of 2524	1156	firefox.exe	firefox.exe
PID 2040 wrote to memory of 4592	2040	IDMan.exe	Uninstall.exe
PID 2040 wrote to memory of 4592	2040	IDMan.exe	Uninstall.exe
PID 2040 wrote to memory of 4592	2040	IDMan.exe	Uninstall.exe
PID 4592 wrote to memory of 4892	4592	Uninstall.exe	RUNDLL32.EXE
PID 4592 wrote to memory of 4892	4592	Uninstall.exe	RUNDLL32.EXE
PID 4892 wrote to memory of 4664	4892	RUNDLL32.EXE	runonce.exe
PID 4892 wrote to memory of 4664	4892	RUNDLL32.EXE	runonce.exe
PID 4664 wrote to memory of 4052	4664	runonce.exe	grpconv.exe
PID 4664 wrote to memory of 4052	4664	runonce.exe	grpconv.exe
PID 2524 wrote to memory of 2024	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 2024	2524	firefox.exe	firefox.exe
PID 4592 wrote to memory of 4300	4592	Uninstall.exe	net.exe
PID 4592 wrote to memory of 4300	4592	Uninstall.exe	net.exe
PID 4592 wrote to memory of 4300	4592	Uninstall.exe	net.exe
PID 4300 wrote to memory of 4080	4300	net.exe	net1.exe
PID 4300 wrote to memory of 4080	4300	net.exe	net1.exe
PID 4300 wrote to memory of 4080	4300	net.exe	net1.exe
PID 4592 wrote to memory of 3392	4592	Uninstall.exe	net.exe
PID 4592 wrote to memory of 3392	4592	Uninstall.exe	net.exe
PID 4592 wrote to memory of 3392	4592	Uninstall.exe	net.exe
PID 3392 wrote to memory of 4920	3392	net.exe	net1.exe
PID 3392 wrote to memory of 4920	3392	net.exe	net1.exe
PID 3392 wrote to memory of 4920	3392	net.exe	net1.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe
PID 2524 wrote to memory of 3252	2524	firefox.exe	firefox.exe

C:\Users\Admin\AppData\Local\Temp\InternetDownloadManagerPortable.exe
"C:\Users\Admin\AppData\Local\Temp\InternetDownloadManagerPortable.exe"
1⤵
- Sets service image path in registry
- Loads dropped DLL
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMan.exe
C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMan.exe
2⤵
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2040

C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMIntegrator64.exe
"C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMIntegrator64.exe" -runcm
3⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3268

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
3⤵
- Suspicious use of WriteProcessMemory
PID:1156

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html
4⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2524.0.858700518\1767979980" -parentBuildID 20200403170909 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 1 -prefMapSize 219940 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2524 "\\.\pipe\gecko-crash-server-pipe.2524" 1788 gpu
5⤵
PID:2024

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2524.3.723032362\318066259" -childID 1 -isForBrowser -prefsHandle 2376 -prefMapHandle 1556 -prefsLen 112 -prefMapSize 219940 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2524 "\\.\pipe\gecko-crash-server-pipe.2524" 2396 tab
5⤵
PID:3252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2524.13.1362760885\1190466487" -childID 2 -isForBrowser -prefsHandle 3636 -prefMapHandle 3684 -prefsLen 6894 -prefMapSize 219940 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2524 "\\.\pipe\gecko-crash-server-pipe.2524" 3656 tab
5⤵
PID:1964

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2524.20.1495426647\1549860566" -childID 3 -isForBrowser -prefsHandle 4196 -prefMapHandle 4144 -prefsLen 6894 -prefMapSize 219940 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2524 "\\.\pipe\gecko-crash-server-pipe.2524" 4248 tab
5⤵
PID:1668

C:\Users\Admin\AppData\Local\Temp\App\IDM\Uninstall.exe
"C:\Users\Admin\AppData\Local\Temp\App\IDM\Uninstall.exe" -instdriv
3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4592

C:\Windows\system32\RUNDLL32.EXE
"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\App\IDM\idmwfp.inf
4⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4892

C:\Windows\system32\runonce.exe
"C:\Windows\system32\runonce.exe" -r
5⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4664

C:\Windows\System32\grpconv.exe
"C:\Windows\System32\grpconv.exe" -o
6⤵
PID:4052

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4080

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
- Suspicious use of WriteProcessMemory
PID:3392

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4920

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
PID:1560

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4964

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
PID:4804

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4352

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
PID:5004

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4476

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" start IDMWFP
4⤵
PID:3800

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start IDMWFP
5⤵
PID:4440

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMShellExt64.dll"
4⤵
PID:3396

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMShellExt64.dll"
5⤵
- Registers COM server for autorun
PID:2144

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMShellExt64.dll"
3⤵
PID:388

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMShellExt64.dll"
4⤵
- Registers COM server for autorun
PID:1648

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMIECC64.dll"
3⤵
PID:3744

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMIECC64.dll"
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:5092

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMGetAll64.dll"
3⤵
PID:3604

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\App\IDM\IDMGetAll64.dll"
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:5088

C:\Windows\SysWOW64\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s "C:\Users\Admin\AppData\Local\Temp\App\IDM\downlWithIDM64.dll"
3⤵
PID:3492

C:\Windows\system32\regsvr32.exe
/s "C:\Users\Admin\AppData\Local\Temp\App\IDM\downlWithIDM64.dll"
4⤵
- Registers COM server for autorun
- Modifies registry class
PID:736

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

3

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IDM\idmfc.dat
Filesize
4KB

MD5
64e902a79acbef7be2a918c9cb431c6a

SHA1
7abe99b612eb52d57f28f1d03262b1671895d53c

SHA256
ca91f9e8a7bb64950656e7aafe0ca9bd5d5331986a4484aa233bb8c7a350b3d2

SHA512
87f98a3a6322b702094b81fc7bd1a6fc88749f2857a5c9701753217f0d82cecc5e6423cdf8472aa68814f4a4d450cb5fc53928831fff946432b477f5d3372f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\IDM\urlexclist.dat
Filesize
3KB

MD5
4260b3d9b4f6b1253e11b257b4a99870

SHA1
2120ce717950eb42121934615cb1af7771d5100f

SHA256
d8e61117caecb4733fef9b3b0cefab1b29c57b5fa48cf2885c65ca9e69904afa

SHA512
ff7bd9e4974c6381d844644f359dcdccfe52b730f3009837f2ec77fe33b0c98d997e94ba9a1ec96ab6bb39635cb7ab9f97372df89181babc50863d401df46229

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswCB46.tmp\System.dll
Filesize
11KB

MD5
fbe295e5a1acfbd0a6271898f885fe6a

SHA1
d6d205922e61635472efb13c2bb92c9ac6cb96da

SHA256
a1390a78533c47e55cc364e97af431117126d04a7faed49390210ea3e89dd0e1

SHA512
2cb596971e504eaf1ce8e3f09719ebfb3f6234cea5ca7b0d33ec7500832ff4b97ec2bbe15a1fbf7e6a5b02c59db824092b9562cd8991f4d027feab6fd3177b06

Download Submit
C:\Users\Admin\AppData\Local\Temp\nswCB46.tmp\registry.dll
Filesize
24KB

MD5
2b7007ed0262ca02ef69d8990815cbeb

SHA1
2eabe4f755213666dbbbde024a5235ddde02b47f

SHA256
0b25b20f26de5d5bd795f934c70447112b4981343fcb2dfab3374a4018d28c2d

SHA512
aa75ee59ca0b8530eb7298b74e5f334ae9d14129f603b285a3170b82103cfdcc175af8185317e6207142517769e69a24b34fcdf0f58ed50a4960cbe8c22a0aca

Download Submit
memory/388-158-0x0000000000000000-mapping.dmp

Download
memory/736-165-0x0000000000000000-mapping.dmp

Download
memory/1560-148-0x0000000000000000-mapping.dmp

Download
memory/1648-160-0x0000000000000000-mapping.dmp

Download
memory/1792-133-0x0000000004820000-0x0000000004834000-memory.dmp

Filesize
80KB

Download
memory/2040-135-0x0000000000000000-mapping.dmp

Download
memory/2144-157-0x0000000000000000-mapping.dmp

Download
memory/3268-136-0x0000000000000000-mapping.dmp

Download
memory/3392-146-0x0000000000000000-mapping.dmp

Download
memory/3396-156-0x0000000000000000-mapping.dmp

Download
memory/3492-164-0x0000000000000000-mapping.dmp

Download
memory/3604-161-0x0000000000000000-mapping.dmp

Download
memory/3744-159-0x0000000000000000-mapping.dmp

Download
memory/3800-154-0x0000000000000000-mapping.dmp

Download
memory/4052-143-0x0000000000000000-mapping.dmp

Download
memory/4080-145-0x0000000000000000-mapping.dmp

Download
memory/4300-144-0x0000000000000000-mapping.dmp

Download
memory/4352-151-0x0000000000000000-mapping.dmp

Download
memory/4440-155-0x0000000000000000-mapping.dmp

Download
memory/4476-153-0x0000000000000000-mapping.dmp

Download
memory/4592-140-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/4592-139-0x0000000000000000-mapping.dmp

Download
memory/4664-142-0x0000000000000000-mapping.dmp

Download
memory/4804-150-0x0000000000000000-mapping.dmp

Download
memory/4892-141-0x0000000000000000-mapping.dmp

Download
memory/4920-147-0x0000000000000000-mapping.dmp

Download
memory/4964-149-0x0000000000000000-mapping.dmp

Download
memory/5004-152-0x0000000000000000-mapping.dmp

Download
memory/5088-163-0x0000000000000000-mapping.dmp

Download
memory/5092-162-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads