4a386815be0781d9ec8defe96bf6818f196b28a1c484357733b13bd8804f2f85

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Wondershare Filmora 11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FilmoraPlayer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	DataReporting.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FilmoraPlayer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MessageService.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Wondershare Filmora 11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	FilmoraPlayer.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	NOTEPAD.EXE

Modifies Installed Components in the registry 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,15063,0"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\IsInstalled = "1"	ie4uinit.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
1136	netsh.exe

Checks BIOS information in registry 2 TTPs 14 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	DataReporting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MessageService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MessageService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	DataReporting.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	FilmoraPlayer.exe

Executes dropped EXE 44 IoCs

pid	Process
4772	filmora_64bit_full846.exe
164	filmora_64bit_full846.tmp
1868	_setup64.tmp
4668	Wondershare Helper Compact.exe
3696	Wondershare Helper Compact.tmp
4924	WSHelper.exe
196	vcredist_x64.exe
2936	install.exe
1608	Wondershare NativePush.exe
3508	Wondershare NativePush.tmp
3388	_setup64.tmp
2356	WsNativePushService.exe
2324	WsNativePushService.exe
3172	WsNativePushService.exe
2404	WsToastNotification.exe
2028	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
4128	AlgorithmRunTest.exe
3964	AlgorithmRunTest.exe
4788	FilmoraPlayer.exe
2308	TC_Medicine11.7.3.exe
652	Blue_BorFX_Medicine.exe
1776	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
3372	AlgorithmRunTest.exe
4060	AlgorithmRunTest.exe
3480	FilmoraPlayer.exe
1660	ocl_check.exe
2344	ocl_check.exe
764	ocl_check.exe
1224	DataReporting.exe
360	WSHelper.exe
3456	FilmoraPlayer.exe
2156	perf_check.exe
5112	wmic.exe
2264	Wondershare Filmora Update(x64).exe
1688	coremediaserver.exe
3700	cmdCheckHEVC.exe
3964	Wondershare Filmora Update(x64).tmp
3312	_setup64.tmp
324	ChromeRecovery.exe
4060	MessageService.exe
5528	CefViewWing.exe
3148	CefViewWing.exe

Loads dropped DLL 64 IoCs

pid	Process
164	filmora_64bit_full846.tmp
164	filmora_64bit_full846.tmp
164	filmora_64bit_full846.tmp
164	filmora_64bit_full846.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
4924	WSHelper.exe
4924	WSHelper.exe
4924	WSHelper.exe
4924	WSHelper.exe
4924	WSHelper.exe
2936	install.exe
2404	WsToastNotification.exe
2404	WsToastNotification.exe
164	filmora_64bit_full846.tmp
164	filmora_64bit_full846.tmp
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe

Registers COM server for autorun 1 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ = "C:\\Windows\\system32\\dxdiagn.dll"	dxdiag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32\ThreadingModel = "Apartment"	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A65B8071-3BFE-4213-9A5B-491DA4461CA7}\InprocServer32	dxdiag.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0002DF01-0000-0000-C000-000000000046}\LocalServer32	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\LocalServer32	WsToastNotification.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\CLSID\{14100442-9664-1407-2647-000000000000}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare NativePush\\WsToastNotification.exe\" -ToastActivated"	WsToastNotification.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}\InprocServer32	dxdiag.exe

Themida packer 9 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/2308-958-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/2308-959-0x00007FF9BB490000-0x00007FF9BC14C000-memory.dmp	themida
behavioral1/memory/2308-993-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/2308-998-0x00007FF9BB490000-0x00007FF9BC14C000-memory.dmp	themida
behavioral1/memory/3480-1013-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/1224-1174-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/3456-1264-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/4060-1362-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida
behavioral1/memory/4060-1365-0x00007FF9C8D40000-0x00007FF9C9641000-memory.dmp	themida

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Wondershare Helper Compact.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Wondershare Helper Compact.exe = "C:\\Program Files (x86)\\Common Files\\Wondershare\\Wondershare Helper Compact\\WSHelper.exe"	Wondershare Helper Compact.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 7 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	DataReporting.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	FilmoraPlayer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MessageService.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Wondershare Filmora 11.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\N:	FilmoraPlayer.exe
File opened (read-only)	\??\F:	FilmoraPlayer.exe
File opened (read-only)	\??\L:	FilmoraPlayer.exe
File opened (read-only)	\??\X:	FilmoraPlayer.exe
File opened (read-only)	\??\Z:	FilmoraPlayer.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	FilmoraPlayer.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	FilmoraPlayer.exe
File opened (read-only)	\??\F:	FilmoraPlayer.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\T:	FilmoraPlayer.exe
File opened (read-only)	\??\M:	FilmoraPlayer.exe
File opened (read-only)	\??\W:	FilmoraPlayer.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	FilmoraPlayer.exe
File opened (read-only)	\??\M:	FilmoraPlayer.exe
File opened (read-only)	\??\P:	FilmoraPlayer.exe
File opened (read-only)	\??\E:	FilmoraPlayer.exe
File opened (read-only)	\??\Y:	FilmoraPlayer.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\K:	FilmoraPlayer.exe
File opened (read-only)	\??\U:	FilmoraPlayer.exe
File opened (read-only)	\??\F:	FilmoraPlayer.exe
File opened (read-only)	\??\Q:	FilmoraPlayer.exe
File opened (read-only)	\??\I:	FilmoraPlayer.exe
File opened (read-only)	\??\S:	FilmoraPlayer.exe
File opened (read-only)	\??\U:	FilmoraPlayer.exe
File opened (read-only)	\??\L:	FilmoraPlayer.exe
File opened (read-only)	\??\R:	FilmoraPlayer.exe
File opened (read-only)	\??\T:	FilmoraPlayer.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	FilmoraPlayer.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	FilmoraPlayer.exe
File opened (read-only)	\??\L:	FilmoraPlayer.exe
File opened (read-only)	\??\Y:	FilmoraPlayer.exe
File opened (read-only)	\??\G:	FilmoraPlayer.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	FilmoraPlayer.exe
File opened (read-only)	\??\J:	FilmoraPlayer.exe
File opened (read-only)	\??\R:	FilmoraPlayer.exe
File opened (read-only)	\??\T:	FilmoraPlayer.exe
File opened (read-only)	\??\V:	FilmoraPlayer.exe
File opened (read-only)	\??\X:	FilmoraPlayer.exe
File opened (read-only)	\??\S:	FilmoraPlayer.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\B:	FilmoraPlayer.exe
File opened (read-only)	\??\N:	FilmoraPlayer.exe
File opened (read-only)	\??\I:	FilmoraPlayer.exe
File opened (read-only)	\??\X:	FilmoraPlayer.exe
File opened (read-only)	\??\Y:	FilmoraPlayer.exe
File opened (read-only)	\??\I:	FilmoraPlayer.exe
File opened (read-only)	\??\P:	FilmoraPlayer.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	FilmoraPlayer.exe
File opened (read-only)	\??\K:	FilmoraPlayer.exe

Writes to the Master Boot Record (MBR) 1 TTPs 7 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	DataReporting.exe
File opened for modification	\??\PhysicalDrive0	FilmoraPlayer.exe
File opened for modification	\??\PhysicalDrive0	MessageService.exe
File opened for modification	\??\PhysicalDrive0	Wondershare Filmora 11.exe
File opened for modification	\??\PhysicalDrive0	FilmoraPlayer.exe
File opened for modification	\??\PhysicalDrive0	Wondershare Filmora 11.exe
File opened for modification	\??\PhysicalDrive0	FilmoraPlayer.exe

Drops file in System32 directory 14 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_74965e869fab271a\mshdc.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\input.inf_amd64_e15abe7d25aa2071\input.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbport.inf_amd64_8e5f608c0111283d\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\msmouse.inf_amd64_b0ca8be2ac09ed24\msmouse.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\machine.inf_amd64_e6c89cc58804e205\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\hdaudbus.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_e6c89cc58804e205\machine.PNF	dxdiag.exe
File created	C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_82738beb7b514250\keyboard.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\hdaudbus.inf_amd64_e22da3cb2d7a1ed6\hdaudbus.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\mshdc.inf_amd64_74965e869fab271a\mshdc.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\usbport.inf_amd64_8e5f608c0111283d\usbport.PNF	dxdiag.exe
File created	\??\c:\windows\system32\driverstore\filerepository\input.inf_amd64_e15abe7d25aa2071\input.PNF	dxdiag.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs

pid	Process
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
4788	FilmoraPlayer.exe
4788	FilmoraPlayer.exe
4788	FilmoraPlayer.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
3480	FilmoraPlayer.exe
3480	FilmoraPlayer.exe
3480	FilmoraPlayer.exe
3480	FilmoraPlayer.exe
1224	DataReporting.exe
1224	DataReporting.exe
1224	DataReporting.exe
1224	DataReporting.exe
3456	FilmoraPlayer.exe
3456	FilmoraPlayer.exe
3456	FilmoraPlayer.exe
3456	FilmoraPlayer.exe
4060	MessageService.exe
4060	MessageService.exe
4060	MessageService.exe
4060	MessageService.exe

Drops file in Program Files directory 58 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-VNGR0.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX\ContinuumOFX\15	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-P39MN.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-H9561.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-HGPS7.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe	Wondershare Helper Compact.tmp
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\manifest.json	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\_metadata\verified_contents.json	elevation_service.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-8ETVI.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Languages\is-VS1TJ.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\is-GU7JG.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-76KFE.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files\BorisFX\ContinuumOFX\15\lib\__tmp_rar_sfx_access_check_241159062	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-HBCCS.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\is-GU8JF.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-GAG6U.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-15493.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-GMP4Q.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-LK14V.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\ChromeRecovery.exe	elevation_service.exe
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\manifest.json	elevation_service.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-F35PL.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-1000S.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-RA5FC.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-JI02G.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-KFQLG.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files\BorisFX\ContinuumOFX\15\lib\Continuum_OFX_8Bit.dll	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-B6JOB.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-7U96F.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX\ContinuumOFX	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-BRFCC.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-61RNR.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Wondershare Helper Compact.exe	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX\ContinuumOFX\15\lib\Continuum_OFX_Float.dll	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-4MK0J.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-UI51I.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Skin\Default\is-P0655.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX\ContinuumOFX\15\lib\Continuum_OFX_8Bit.dll	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-I1ACH.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-PH734.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-L6R5I.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\BorisFX\ContinuumOFX\15\lib	Blue_BorFX_Medicine.exe
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\ChromeRecoveryCRX.crx	elevation_service.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\unins000.dat	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-881IF.tmp	Wondershare Helper Compact.tmp
File opened for modification	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\ChromeRecovery.exe	elevation_service.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-0H5P0.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-8DF58.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-GS4E8.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\_metadata\verified_contents.json	elevation_service.exe
File opened for modification	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.ini	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe_temp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\images\is-6M5QA.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files\BorisFX\ContinuumOFX\15\lib\Continuum_OFX_Float.dll	Blue_BorFX_Medicine.exe
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\is-OI5DF.tmp	Wondershare Helper Compact.tmp
File created	C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\Pages\suit\style\is-TGS60.tmp	Wondershare Helper Compact.tmp

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	\??\c:\Windows\Installer\e5e3508.msi	msiexec.exe
File created	\??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441586.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441614.1\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90enu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90rus.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441599.1	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441614.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441552.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441614.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441552.0\msvcp90.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441552.0	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90jpn.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441599.0	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441599.1\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90cht.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90deu.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\mfc90u.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441568.0	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441568.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441599.0\9.0.30729.4148.policy	msiexec.exe
File created	\??\c:\Windows\Installer\e5e350b.msi	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441586.0	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\e5e3508.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39CB.tmp	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_480678f3.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90chs.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\mfcm90u.dll	msiexec.exe
File opened for modification	C:\Windows\setuperr.log	dxdiag.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90fra.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441586.1\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441552.0\msvcr90.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E\9.0.30729\FL_msdia71_dll_2_60035_amd64_ln.3643236F_FC70_11D3_A536_0090278A1BB8	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441505.0\atl90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d7860533.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441505.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_673f7fa2.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90ita.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90kor.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\mfcm90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441505.0	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441599.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\amd64_Microsoft.VC90.MFC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_d7860533.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\amd64_Microsoft.VC90.MFCLOC_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_480678f3.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441586.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441505.0\amd64_Microsoft.VC90.ATL_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_673f7fa2.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441586.0\amd64_Microsoft.VC90.OpenMP_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_22d6ba8a.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441614.0\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90esp.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441552.0\msvcm90.dll	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441614.0\9.0.30729.4148.policy	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441586.0\vcomp90.dll	msiexec.exe
File opened for modification	C:\Windows\WinSxS\InstallTemp\20230203185441614.1	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441599.1\9.0.30729.4148.cat	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441552.0\amd64_Microsoft.VC90.CRT_1fc8b3b9a1e18e3b_9.0.30729.4148_x-ww_069f922e.manifest	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.0\mfc90.dll	msiexec.exe
File opened for modification	C:\Windows\setupact.log	dxdiag.exe
File opened for modification	\??\c:\Windows\Installer\	msiexec.exe
File created	C:\Windows\WinSxS\InstallTemp\20230203185441568.1\mfc90esn.dll	msiexec.exe
File opened for modification	\??\c:\Windows\Installer\$PatchCache$\Managed\1007C6B46D7C017319E3B52CF3EC196E	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 9 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	dxdiag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dxdiag.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wondershare Filmora 11.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	wmic.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	coremediaserver.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	cmdCheckHEVC.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wondershare Filmora 11.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Wondershare Filmora 11.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Wondershare Filmora 11.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	Wondershare Filmora 11.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wmic.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	coremediaserver.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	cmdCheckHEVC.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Wondershare Filmora 11.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
5248	TASKKILL.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\Capabilities	ie4uinit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Hidden = "0"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "12"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	filmora_64bit_full846.tmp
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\Wondershare Filmora 11.exe = "9999"	filmora_64bit_full846.tmp
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E993643-8FBC-44FE-BC85-D318495C4D96}\LocalServer32	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\41A387AA3A7A33D3590FA953D1350011	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib\Version = "1.1"	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\ProxyStubClsid32	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E5E91D68-955D-4DE1-AB8E-89B26DF6A331}	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WFPFile\Shell\Open\Command	filmora_64bit_full846.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wfip	filmora_64bit_full846.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\open\ = "Open in S&ame Window"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0FA988D3-BA51-48AD-A518-6462CD5FF547}\ = "IExceptionLog"	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\DefaultIcon\ = "C:\\Program Files (x86)\\Internet Explorer\\IEXPLORE.EXE,-17"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\open\MUIVerb = "@C:\\Windows\\system32\\ieframe.dll,-5732"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0477E5C9-0877-499A-8A7C-154C777293DC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WSHelper.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0\NodeSlot = "30"	Wondershare Filmora 11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wfps\ = "WFPSFile"	filmora_64bit_full846.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\DefaultIcon	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\TypeLib	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{46884330-13BA-4AC9-BEDC-3A2E955EB8DA}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}"	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{55DB3C89-37B9-41E8-87CC-7C578D2F5374}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1007C6B46D7C017319E3B52CF3EC196E\FT_VC_Redist_CRT_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\1\1\0 = 840031000000000043568e961100444f43554d457e3100006c0009000400efbe0c55a78943568e962e000000a35201000000010000000000000000004200000000001cf60d0044006f00630075006d0065006e0074007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370037003000000018000000	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\ftp\shell\open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\shell\open\CommandId = "IE.File"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WFPBundlesFile\path = "C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare Filmora"	filmora_64bit_full846.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\printto\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Features\1007C6B46D7C017319E3B52CF3EC196E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4D3609D2-1D8A-4E9F-884B-438AFDDECB86}\TypeLib	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{36B0BA4B-20B5-4369-BBCA-9FAADC8EAC19}\ProxyStubClsid32	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E5E91D68-955D-4DE1-AB8E-89B26DF6A331}\TypeLib\Version = "1.1"	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\1007C6B46D7C017319E3B52CF3EC196E\FT_VC_Redist_MFC_x64 = "VC_Redist_12222_amd64_enu"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\1007C6B46D7C017319E3B52CF3EC196E\SourceList\PackageName = "vc_red.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WFPBundlesFile\Shell\Open	filmora_64bit_full846.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WFPTSFile\Shell\Open\ = "&Open"	filmora_64bit_full846.tmp
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\iexplore.exe\shell\open	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\AppUserModelId\Wondershare.NotificationApp\DisplayName = "Wondershare"	WsToastNotification.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagProvider.1\CLSID	dxdiag.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\2\0\0 = 62003100000000004356bd9610005052455345547e3100004a0009000400efbe4356bd964356bd962e000000170603000000020000000000000000000000000000003acc3800500072006500730065007400200056006900640065006f00000018000000	Wondershare Filmora 11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\Shell\Open\	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70AC1FC1-A22B-4327-9A54-754B9301A056}\TypeLib\Version = "1.1"	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WSCustomerServicePlatform.CustomerService	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1839CDE-A191-4DA4-9FCE-178A88318DF4}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}"	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EEB1CAE3-D0B2-446E-AEDE-727AA9089A1B}	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	Wondershare Filmora 11.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WFIPFile\Shell\Open\Command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Wondershare\\Wondershare Filmora\\Wondershare Filmora 11.exe\" \"%1\""	filmora_64bit_full846.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\DefaultIcon\ = "%SystemRoot%\\system32\\url.dll,5"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\xhtmlfile\DefaultIcon	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.xht\ = "xhtmlfile"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Microsoft.Website\shellex\ContextMenuHandlers\{a2a9545d-a0c2-42b4-9708-a0b2badd77c8}	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\InternetShortcut\shell\Open\command	ie4uinit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{70AC1FC1-A22B-4327-9A54-754B9301A056}	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WFPSFile\Shell	filmora_64bit_full846.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wfpts\ = "WFPTSFile"	filmora_64bit_full846.tmp
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\https\ = "URL:HyperText Transfer Protocol with Privacy"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Win32Assemblies\Global	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DxDiag.DxDiagClassObject\CurVer	dxdiag.exe
Key created	\REGISTRY\USER\S-1-5-21-2482096546-1136599444-1359412500-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\svgfile\shell\ = "opennew"	ie4uinit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E90BA470-0728-47E6-B2E7-0ED0C0CFEA8F}\TypeLib\ = "{D85C6069-D628-4276-93C3-9A94E5338D8B}"	WSHelper.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5610D1A9-5B54-4E77-9190-94FF9E59AFBA}\TypeLib	WSHelper.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F0ABE7E0-32E3-472E-924C-162B1996DC23}\ = "IPayPerView"	WSHelper.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4976	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 9 IoCs

pid	Process
376	Wondershare Filmora 11.exe
4788	FilmoraPlayer.exe
2308	Wondershare Filmora 11.exe
3480	FilmoraPlayer.exe
1224	DataReporting.exe
3456	FilmoraPlayer.exe
5304	explorer.exe
5224	vlc.exe
4060	MessageService.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2116	powershell.exe
2116	powershell.exe
2116	powershell.exe
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
3696	Wondershare Helper Compact.tmp
2932	msiexec.exe
2932	msiexec.exe
3508	Wondershare NativePush.tmp
3508	Wondershare NativePush.tmp
3172	WsNativePushService.exe
3172	WsNativePushService.exe
3172	WsNativePushService.exe
3172	WsNativePushService.exe
1280	chrome.exe
1280	chrome.exe
3596	chrome.exe
3596	chrome.exe
3456	chrome.exe
3456	chrome.exe
432	chrome.exe
432	chrome.exe
868	chrome.exe
868	chrome.exe
1704	chrome.exe
1704	chrome.exe
2028	Wondershare Filmora 11.exe
2028	Wondershare Filmora 11.exe
2260	chrome.exe
2260	chrome.exe
5088	chrome.exe
5088	chrome.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
3596	chrome.exe
3596	chrome.exe
712	chrome.exe
712	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
4616	chrome.exe
1776	Wondershare Filmora 11.exe
1776	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
1688	coremediaserver.exe
1688	coremediaserver.exe
1688	coremediaserver.exe
1688	coremediaserver.exe
1688	coremediaserver.exe
1688	coremediaserver.exe
2404	WsToastNotification.exe

Suspicious behavior: GetForegroundWindowSpam 7 IoCs

pid	Process
2984	OpenWith.exe
164	filmora_64bit_full846.tmp
376	Wondershare Filmora 11.exe
2308	Wondershare Filmora 11.exe
3456	FilmoraPlayer.exe
5224	vlc.exe
4060	MessageService.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	4188	7zG.exe
Token: 35	4188	7zG.exe
Token: SeSecurityPrivilege	4188	7zG.exe
Token: SeSecurityPrivilege	4188	7zG.exe
Token: SeDebugPrivilege	2116	powershell.exe
Token: SeShutdownPrivilege	2936	install.exe
Token: SeIncreaseQuotaPrivilege	2936	install.exe
Token: SeSecurityPrivilege	2932	msiexec.exe
Token: SeCreateTokenPrivilege	2936	install.exe
Token: SeAssignPrimaryTokenPrivilege	2936	install.exe
Token: SeLockMemoryPrivilege	2936	install.exe
Token: SeIncreaseQuotaPrivilege	2936	install.exe
Token: SeMachineAccountPrivilege	2936	install.exe
Token: SeTcbPrivilege	2936	install.exe
Token: SeSecurityPrivilege	2936	install.exe
Token: SeTakeOwnershipPrivilege	2936	install.exe
Token: SeLoadDriverPrivilege	2936	install.exe
Token: SeSystemProfilePrivilege	2936	install.exe
Token: SeSystemtimePrivilege	2936	install.exe
Token: SeProfSingleProcessPrivilege	2936	install.exe
Token: SeIncBasePriorityPrivilege	2936	install.exe
Token: SeCreatePagefilePrivilege	2936	install.exe
Token: SeCreatePermanentPrivilege	2936	install.exe
Token: SeBackupPrivilege	2936	install.exe
Token: SeRestorePrivilege	2936	install.exe
Token: SeShutdownPrivilege	2936	install.exe
Token: SeDebugPrivilege	2936	install.exe
Token: SeAuditPrivilege	2936	install.exe
Token: SeSystemEnvironmentPrivilege	2936	install.exe
Token: SeChangeNotifyPrivilege	2936	install.exe
Token: SeRemoteShutdownPrivilege	2936	install.exe
Token: SeUndockPrivilege	2936	install.exe
Token: SeSyncAgentPrivilege	2936	install.exe
Token: SeEnableDelegationPrivilege	2936	install.exe
Token: SeManageVolumePrivilege	2936	install.exe
Token: SeImpersonatePrivilege	2936	install.exe
Token: SeCreateGlobalPrivilege	2936	install.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe
Token: SeTakeOwnershipPrivilege	2932	msiexec.exe
Token: SeRestorePrivilege	2932	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4188	7zG.exe
4188	7zG.exe
4976	NOTEPAD.EXE
164	filmora_64bit_full846.tmp
4924	WSHelper.exe
3508	Wondershare NativePush.tmp
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
3596	chrome.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
2620	taskmgr.exe
5224	vlc.exe
5224	vlc.exe
5224	vlc.exe
5224	vlc.exe
5224	vlc.exe
5224	vlc.exe
5224	vlc.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
2984	OpenWith.exe
4924	WSHelper.exe
376	Wondershare Filmora 11.exe
376	Wondershare Filmora 11.exe
4788	FilmoraPlayer.exe
2308	TC_Medicine11.7.3.exe
2308	TC_Medicine11.7.3.exe
652	Blue_BorFX_Medicine.exe
652	Blue_BorFX_Medicine.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe
4500	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 164	4772	filmora_64bit_full846.exe	82
PID 4772 wrote to memory of 164	4772	filmora_64bit_full846.exe	82
PID 4772 wrote to memory of 164	4772	filmora_64bit_full846.exe	82
PID 164 wrote to memory of 2116	164	filmora_64bit_full846.tmp	83
PID 164 wrote to memory of 2116	164	filmora_64bit_full846.tmp	83
PID 164 wrote to memory of 1868	164	filmora_64bit_full846.tmp	85
PID 164 wrote to memory of 1868	164	filmora_64bit_full846.tmp	85
PID 164 wrote to memory of 5032	164	filmora_64bit_full846.tmp	87
PID 164 wrote to memory of 5032	164	filmora_64bit_full846.tmp	87
PID 164 wrote to memory of 1136	164	filmora_64bit_full846.tmp	88
PID 164 wrote to memory of 1136	164	filmora_64bit_full846.tmp	88
PID 164 wrote to memory of 684	164	filmora_64bit_full846.tmp	89
PID 164 wrote to memory of 684	164	filmora_64bit_full846.tmp	89
PID 164 wrote to memory of 892	164	filmora_64bit_full846.tmp	90
PID 164 wrote to memory of 892	164	filmora_64bit_full846.tmp	90
PID 164 wrote to memory of 4668	164	filmora_64bit_full846.tmp	92
PID 164 wrote to memory of 4668	164	filmora_64bit_full846.tmp	92
PID 164 wrote to memory of 4668	164	filmora_64bit_full846.tmp	92
PID 4668 wrote to memory of 3696	4668	Wondershare Helper Compact.exe	93
PID 4668 wrote to memory of 3696	4668	Wondershare Helper Compact.exe	93
PID 4668 wrote to memory of 3696	4668	Wondershare Helper Compact.exe	93
PID 3696 wrote to memory of 4924	3696	Wondershare Helper Compact.tmp	95
PID 3696 wrote to memory of 4924	3696	Wondershare Helper Compact.tmp	95
PID 3696 wrote to memory of 4924	3696	Wondershare Helper Compact.tmp	95
PID 164 wrote to memory of 196	164	filmora_64bit_full846.tmp	96
PID 164 wrote to memory of 196	164	filmora_64bit_full846.tmp	96
PID 164 wrote to memory of 196	164	filmora_64bit_full846.tmp	96
PID 196 wrote to memory of 2936	196	vcredist_x64.exe	97
PID 196 wrote to memory of 2936	196	vcredist_x64.exe	97
PID 164 wrote to memory of 1608	164	filmora_64bit_full846.tmp	99
PID 164 wrote to memory of 1608	164	filmora_64bit_full846.tmp	99
PID 164 wrote to memory of 1608	164	filmora_64bit_full846.tmp	99
PID 1608 wrote to memory of 3508	1608	Wondershare NativePush.exe	100
PID 1608 wrote to memory of 3508	1608	Wondershare NativePush.exe	100
PID 1608 wrote to memory of 3508	1608	Wondershare NativePush.exe	100
PID 3508 wrote to memory of 3388	3508	Wondershare NativePush.tmp	101
PID 3508 wrote to memory of 3388	3508	Wondershare NativePush.tmp	101
PID 3508 wrote to memory of 1136	3508	Wondershare NativePush.tmp	103
PID 3508 wrote to memory of 1136	3508	Wondershare NativePush.tmp	103
PID 3508 wrote to memory of 2356	3508	Wondershare NativePush.tmp	106
PID 3508 wrote to memory of 2356	3508	Wondershare NativePush.tmp	106
PID 3508 wrote to memory of 2324	3508	Wondershare NativePush.tmp	108
PID 3508 wrote to memory of 2324	3508	Wondershare NativePush.tmp	108
PID 3172 wrote to memory of 2404	3172	WsNativePushService.exe	112
PID 3172 wrote to memory of 2404	3172	WsNativePushService.exe	112
PID 164 wrote to memory of 3596	164	filmora_64bit_full846.tmp	113
PID 164 wrote to memory of 3596	164	filmora_64bit_full846.tmp	113
PID 3596 wrote to memory of 3664	3596	chrome.exe	114
PID 3596 wrote to memory of 3664	3596	chrome.exe	114
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116
PID 3596 wrote to memory of 860	3596	chrome.exe	116

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\WS.Filmora.11.7.3.814.w64.rar
1⤵
PID:2496

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:2984

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3624

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\WS.Filmora.11.7.3.814.w64\" -ad -an -ai#7zMap12970:130:7zEvent5834
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4188

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\Readme.txt
1⤵
- Opens file in notepad (likely ransom note)
- Suspicious use of FindShellTrayWindow
PID:4976

C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\filmora_64bit_full846.exe
"C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\filmora_64bit_full846.exe"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Users\Admin\AppData\Local\Temp\is-JE435.tmp\filmora_64bit_full846.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-JE435.tmp\filmora_64bit_full846.tmp" /SL5="$20330,464353272,421888,C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\filmora_64bit_full846.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:164
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "powershell.exe" [Environment]::GetFolderPath('MyDocuments') | Out-File "C:\Users\Public\Documents\B30281EA-BA02-4586-86F8-C9BE813884C1.txt" -Encoding UTF8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2116
- - C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\_isetup\_setup64.tmp
    helper 105 0x394
    3⤵
    - Executes dropped EXE
    PID:1868
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s atimpenc.dll
    3⤵
    PID:5032
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s atixcode.dll
    3⤵
    PID:1136
- - C:\Windows\system32\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s CFDecode64.ax
    3⤵
    PID:684
- - C:\Windows\system32\ie4uinit.exe
    "C:\Windows\system32\ie4uinit.exe" -show
    3⤵
    - Modifies Installed Components in the registry
    - Registers COM server for autorun
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:892
- - C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\Wondershare Helper Compact.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\Wondershare Helper Compact.exe" /VERYSILENT /SP-
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\is-3NQ68.tmp\Wondershare Helper Compact.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-3NQ68.tmp\Wondershare Helper Compact.tmp" /SL5="$1039E,2101212,54272,C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\Wondershare Helper Compact.exe" /VERYSILENT /SP-
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Adds Run key to start application
      Drops file in Program Files directory
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:3696
    - - C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe
        
        "C:\Program Files (x86)\Common Files\Wondershare\Wondershare Helper Compact\WSHelper.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4924
- - C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\vcredist_x64.exe
    "C:\Users\Admin\AppData\Local\Temp\is-6T4O1.tmp\vcredist_x64.exe" /q
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:196
  - - \??\c:\60eb8cab421249f901\install.exe
      c:\60eb8cab421249f901\.\install.exe /q
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:2936
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\is-CHCMN.tmp\Wondershare NativePush.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-CHCMN.tmp\Wondershare NativePush.tmp" /SL5="$503C2,2940891,938496,C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare NativePush.exe" /VERYSILENT /BINDINSTALL
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3508
    - - C:\Users\Admin\AppData\Local\Temp\is-TM76G.tmp\_isetup\_setup64.tmp
        
        helper 105 0x3EC
        5⤵
        Executes dropped EXE
        
        PID:3388
    - - C:\Windows\system32\netsh.exe
        
        "netsh.exe" advfirewall firewall add rule name="WsToastNotification" dir=in security=authnoencap action=allow program="C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe"
        5⤵
        Modifies Windows Firewall
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe
        
        "C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe" install
        5⤵
        Executes dropped EXE
        
        PID:2356
    - - C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe
        
        "C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe" start
        5⤵
        Executes dropped EXE
        
        PID:2324
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" http://cbs.wondershare.com/go.php?pid=846&m=i&product_version=11.7.3.814&client_sign={32F18BD3-1ECE-4020-8949-0B6EB7162604}&is_silent_install=0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xec,0xf0,0xf4,0xc8,0xf8,0x7ff9cf0d4f50,0x7ff9cf0d4f60,0x7ff9cf0d4f70
      4⤵
      PID:3664
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1680 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1280
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1508 /prefetch:2
      4⤵
      PID:860
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2136 /prefetch:8
      4⤵
      PID:2548
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2680 /prefetch:1
      4⤵
      PID:1256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2672 /prefetch:1
      4⤵
      PID:4992
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
      4⤵
      PID:3968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4128 /prefetch:8
      4⤵
      PID:3952
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2820 /prefetch:1
      4⤵
      PID:3296
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4284 /prefetch:1
      4⤵
      PID:2056
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
      4⤵
      PID:1472
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3456
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5796 /prefetch:8
      4⤵
      PID:4344
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:432
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:1008
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5884 /prefetch:8
      4⤵
      PID:4112
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5856 /prefetch:8
      4⤵
      PID:748
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
      4⤵
      PID:352
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:868
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5380 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1704
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2260
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:5088
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5568 /prefetch:8
      4⤵
      PID:2696
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=800 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:712
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4544 /prefetch:8
      4⤵
      PID:4544
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
      4⤵
      PID:4192
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=804 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4616
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
      4⤵
      PID:2936
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5532 /prefetch:8
      4⤵
      PID:4256
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4564 /prefetch:8
      4⤵
      PID:5292
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5916 /prefetch:8
      4⤵
      PID:5836
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=888 /prefetch:8
      4⤵
      PID:5184
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
      4⤵
      PID:2968
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1572,17651307475028399291,7459500885824843109,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2552 /prefetch:8
      4⤵
      PID:5328
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2028
  - - C:\Windows\explorer.exe
      "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe
      4⤵
      PID:3712

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe
"C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsNativePushService.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe
  "C:\Users\Admin\AppData\Local\Wondershare\Wondershare NativePush\WsToastNotification.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2404

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1896
- C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe
  "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:376
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive where index=1 get serialnumber
    3⤵
    PID:4632
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814\resources" 0
    3⤵
    - Executes dropped EXE
    PID:4128
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814\resources" 1
    3⤵
    - Executes dropped EXE
    PID:3964
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe" check
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:4788

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2620

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3dc
1⤵
PID:1700

C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\TC_Medicine11.7.3.exe
"C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\TC_Medicine11.7.3.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2308

C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\Blue_BorFX_Medicine.exe
"C:\Users\Admin\Desktop\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\WS.Filmora.11.7.3.814.w64\Blue_BorFX_Medicine.exe"
1⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:652

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4500
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Windows\System32\drivers\etc\hosts
  2⤵
  - Drops file in Drivers directory
  PID:4256

C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe
"C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\Wondershare Filmora 11.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1776
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe
  2⤵
  PID:4200

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:2984
- C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe
  "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora 11.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  PID:2308
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive where index=1 get serialnumber
    3⤵
    PID:3676
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814\resources" 0
    3⤵
    - Executes dropped EXE
    PID:3372
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\AlgorithmRunTest.exe" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814" "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814\resources" 1
    3⤵
    - Executes dropped EXE
    PID:4060
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe" check
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: AddClipboardFormatListener
    PID:3480
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe" --blacklist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_black_list.xml" --whitelist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_white_list.xml" --gpu 0 --result "C:/Users/Admin/Documents\Wondershare/Wondershare Filmora\GPUConfig"\ --recheck 0
    3⤵
    - Executes dropped EXE
    PID:1660
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe" --blacklist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_black_list.xml" --whitelist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_white_list.xml" --gpu 1 --result "C:/Users/Admin/Documents\Wondershare/Wondershare Filmora\GPUConfig"\ --recheck 0
    3⤵
    - Executes dropped EXE
    PID:2344
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\ocl_check.exe" --blacklist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_black_list.xml" --whitelist "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\opencl_white_list.xml" --gpu 2 --result "C:/Users/Admin/Documents\Wondershare/Wondershare Filmora\GPUConfig"\ --recheck 0
    3⤵
    - Executes dropped EXE
    PID:764
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\DataReporting.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\DataReporting.exe" WondershareFilmora
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: AddClipboardFormatListener
    PID:1224
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive where index=1 get serialnumber
    3⤵
    PID:4660
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\FilmoraPlayer.exe" ""
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Enumerates connected drives
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:3456
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\perf_check.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\perf_check.exe" --hwinfo "C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora/11.7.3.814/hwinfo.json"
    3⤵
    - Executes dropped EXE
    PID:2156
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c dxdiag.exe /dontskip /whql:off /x C:\Users\Admin\AppData\Local\Temp\_000000D7DEEFFA18_.xml
      4⤵
      PID:1336
    - - C:\Windows\system32\dxdiag.exe
        
        dxdiag.exe /dontskip /whql:off /x C:\Users\Admin\AppData\Local\Temp\_000000D7DEEFFA18_.xml
        5⤵
        Registers COM server for autorun
        Drops file in System32 directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Modifies registry class
        
        PID:516
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c del /f /s /q C:\Users\Admin\AppData\Local\Temp\_000000D7DEEFFA18_.xml
      4⤵
      PID:5520
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\cmdCheckATI.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\cmdCheckATI.exe"
    3⤵
    PID:5112
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora Update(x64).exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\\Wondershare Filmora Update(x64).exe" /VERYSILENT /SP- "/DIR=C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora Update/"
    3⤵
    - Executes dropped EXE
    PID:2264
  - - C:\Users\Admin\AppData\Local\Temp\is-7LCVT.tmp\Wondershare Filmora Update(x64).tmp
      "C:\Users\Admin\AppData\Local\Temp\is-7LCVT.tmp\Wondershare Filmora Update(x64).tmp" /SL5="$4040A,8177289,163840,C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Wondershare Filmora Update(x64).exe" /VERYSILENT /SP- "/DIR=C:/Users/Admin/AppData/Local/Wondershare/Wondershare Filmora Update/"
      4⤵
      Executes dropped EXE
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\is-294L7.tmp\_isetup\_setup64.tmp
        
        helper 105 0x3EC
        5⤵
        Executes dropped EXE
        
        PID:3312
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\coremediaserver.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\coremediaserver.exe" bd1a36123630429c-aa9b13b43c190a6b 23542 2308 "C:\Users\Admin\AppData\Local\Temp\Wondershare Filmora\MediaInfo\Wondershare Filmora 11.exe.sqldb" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\proxypath" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\" "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\Log"
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    PID:1688
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\cmdCheckHEVC.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\cmdCheckHEVC.exe" 875967049 320 240 1000 3000
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:3700
- - C:\Windows\System32\Wbem\wmic.exe
    wmic diskdrive where index=1 get serialnumber
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    PID:5112
- - C:\Windows\explorer.exe
    explorer /select, "C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Output\My Video.mp4"
    3⤵
    PID:3964
- - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\MessageService.exe
    "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\MessageService.exe" CMD_NATIVEENGINE_METHORD_CLICK_CADDY -1 "" "{ \"accessToken\": \"\", \"autoLoginToken\": \"\", \"deviveUsedCount\": \"-1\", \"email\": \"\", \"expiresTime\": \"1675450811\", \"firstName\": \"\", \"lastName\": \"\", \"licenseType\": \"0\", \"loginState\": \"0\", \"maxDeviveCount\": \"-1\", \"nAvatar\": \"\", \"nickName\": \"\", \"refreshToken\": \"\", \"uid\": \"\" } "
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious behavior: GetForegroundWindowSpam
    PID:4060
  - - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\CefViewWing.exe
      "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\CefViewWing.exe" --type=gpu-process --no-sandbox --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\debug.log" --log-severity=verbose --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814" --user-agent="CEF3.3538.1852.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --lang=en-US --gpu-preferences=KAAAAAAAAACAAwBAAQAAAAAAAAAAAGAAAAAAAAAAAAAIAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAKAAAAEAAAAAAAAAAAAAAACwAAABAAAAAAAAAAAQAAAAoAAAAQAAAAAAAAAAEAAAALAAAA --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\debug.log" --log-severity=verbose --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814" --user-agent="CEF3.3538.1852.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --lang=en-US --service-request-channel-token=17789937545681945604 --mojo-platform-channel-handle=1740 /prefetch:2
      4⤵
      Executes dropped EXE
      PID:5528
  - - C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\CefViewWing.exe
      "C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\CefViewWing.exe" --type=renderer --no-sandbox --force-device-scale-factor=1 --service-pipe-token=14698208365706329142 --lang=en-US --locales-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\locales" --log-file="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814\debug.log" --log-severity=verbose --resources-dir-path="C:\Users\Admin\AppData\Local\Wondershare\Wondershare Filmora\11.7.3.814" --user-agent="CEF3.3538.1852.win64/QCefView 1.0 (Windows; en-us) wondershare_filmora_win" --device-scale-factor=1 --num-raster-threads=1 --service-request-channel-token=14698208365706329142 --renderer-client-id=3 --mojo-platform-channel-handle=2584 /prefetch:1
      4⤵
      Executes dropped EXE
      PID:3148
  - - C:\Windows\SYSTEM32\TASKKILL.exe
      TASKKILL.exe /F /IM MessageService.exe
      4⤵
      Kills process with taskkill
      PID:5248

C:\PROGRA~2\COMMON~1\WONDER~1\WONDER~1\WSHelper.exe
C:\PROGRA~2\COMMON~1\WONDER~1\WONDER~1\WSHelper.exe -Embedding
1⤵
- Executes dropped EXE
PID:360

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
PID:5304
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Documents\Wondershare\Wondershare Filmora\Output\My Video-highlight.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SendNotifyMessage
  PID:5224

C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"
1⤵
- Drops file in Program Files directory
PID:5308
- C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\ChromeRecovery.exe
  "C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir5308_129792926\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={396ef623-96ac-41ef-a116-4c91872250e0} --system
  2⤵
  - Executes dropped EXE
  PID:324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery