Analysis
-
max time kernel
88s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2023 23:47
Behavioral task
behavioral1
Sample
EliStarA.exe
Resource
win7-20230220-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
EliStarA.exe
Resource
win10v2004-20230220-en
dmalockerhawkeyelockylocky_osirismodiloaderwannacrydiscoverykeyloggerpersistenceransomwarespywarestealertrojanupxworm
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
EliStarA.exe
-
Size
1.7MB
-
MD5
6b8dcb09a6f8e836b5dcc600d11c6223
-
SHA1
b0a1582b9e9871064afae5cb6b1d369599506763
-
SHA256
11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
-
SHA512
feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
-
SSDEEP
49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E
Malware Config
Signatures
-
DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe -
Drops file in Drivers directory 22 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\ISPUPDRV.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver.txt EliStarA.exe File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-20 234802) EliStarA.exe File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver2.txt EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver2.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-20 234802) EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\ISPUPDRV.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\config.json EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\config.json EliStarA.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" EliStarA.exe -
Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AppointmentApis.Lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\yourfile.exe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\convert.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exploerss.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JOJO.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\win32.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DEEWOO.LNK EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tempadexpac.exe.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HpuEtzbXyw.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rootvimkvddoarv.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ksea.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nctwe.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sv.exe.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DGOLKDGKJGBKJDGIKJ.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntry.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csAiprbfef.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\displaymedia.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdfnme.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chrome.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wuid.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dth54.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TSTheme.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Good morning DECRYPT FILES.jpg EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ufyd.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\scvhost.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\firefoxxx.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tHwMAS.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apps.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vcdfcfghjghtkhjbnvgh.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SANTA.BAT EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\obhn.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PkKqJI.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Host.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bnmanager.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hjdfasd.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mfsrcsnk.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wscsvc.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asvcbfgh.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rde~aa009765678-987656bn.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\staxnet.vbe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\diskraid.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\file.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Good morning.txt EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MaxxAudioMeters64.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WMPDMC.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdfgfdsdfd.exe.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Edge.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BuqcdD1n.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADFGHJ.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sys30.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BbIGzz.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ios.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Premi_Si.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system32helper.exe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uyhf.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\update.exe.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\regedt32.Lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\A859A2.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\usvc32.lnk EliStarA.exe -
resource yara_rule behavioral2/memory/4720-133-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/4720-140-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/4720-141-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/4720-142-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/4720-145-0x0000000000400000-0x00000000005BF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\WINDOWS\autorun.inf EliStarA.exe File opened for modification C:\autorun.inf EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\AUTORUN.INF EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\AUTORUN.INF EliStarA.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSTEM32\SEARCHX.HTML EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\RK.BIN EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\NORUNS.REG EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\USER44.ICO EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\DB EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Ions2 EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Ions2 EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\DPI Service EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\INISTONE.INI EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Microsoft LocalManager EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\skdbn.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\AHTN.HTM EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\abengine.ini EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\zdengine.ini EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Miscfost EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\MyCloud Disk EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\DELSELF.BAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\OG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Free Advanced Tuneup utilities for Windows EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\p.ico EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\s.ico EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\autorun.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\WPA Service Task EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\KB95842.LOG EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\SILC_DLL.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\WinHostStartForMachne EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Telemetry Logging EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\___t EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WARNINGS.HTML EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SQL_1.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\w.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\dskdgnostbat.key EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\___u EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\dllhost.exe EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\UL.DLL EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\werwqerweqrwe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WinSK\TLLWL.XCV EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WinRing0x64.sys EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WINVIEW.OCX EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\MSWMPDAT.TLB EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SYA.TXT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Nano EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\NORUNS.REG EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\raserver EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Ms new library EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\TBPS.INI EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SpywareWarning.mht EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Critical_Warning.html EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Nafnifas EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\WwANsvc EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Shell File Extensions EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\System Health Application EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\vget.exe EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Task Health Application EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\{4EA29966-F266-4038-80A9-1DEC42740035} EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Time Trigger Task EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Miscfost EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SPI.DLL EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\WindowsInput.InstallState EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Cache System Extension EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Com\KLOG.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\RK.BIN EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\PowerControl LG EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\DLL1.tmp EliStarA.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\log.txt EliStarA.exe File opened for modification C:\Program Files\NetMeeting\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Lycos\Sidesearch\OFFLINE.HTM EliStarA.exe File opened for modification C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exe.config EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exex EliStarA.exe File opened for modification C:\Program Files\Common Files\Systems\PINKS.DLL EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\JS.MUI EliStarA.exe File opened for modification C:\Program Files\Outlook Express\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Movie Maker\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ONLO0R.OBK EliStarA.exe File opened for modification C:\Program Files\VERSION.TXT EliStarA.exe File opened for modification C:\Program Files\X.BMP EliStarA.exe File opened for modification C:\Program Files\JustClicking\home.bat EliStarA.exe File opened for modification C:\Program Files\installESP.log EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\Windows Update.exe.config EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.ex_ EliStarA.exe File opened for modification C:\Program Files\WebRebates4\Websrebates\Webtrebates\toprC0.htm EliStarA.exe File opened for modification C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ACPI.VXD EliStarA.exe File opened for modification C:\Program Files\Assembly\System.exe.config EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\DMLCONF.DAT EliStarA.exe File opened for modification C:\Program Files\Common Files\System\Uninstall\Uninstall A360.lnk EliStarA.exe File opened for modification C:\Program Files\Messenger Plus! Live\Scripts\hola\hola.js EliStarA.exe File opened for modification C:\Program Files\Messenger\KLOG.DAT EliStarA.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYS.REG EliStarA.exe File opened for modification C:\WINDOWS\Tasks\ChromeDataStorage.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\DealPlyUpdate.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Milieukravene.job EliStarA.exe File opened for modification C:\WINDOWS\Media\libstdc++-6.dll EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms Cloud Network.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\MsTools.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows Power saves tools for windows.job EliStarA.exe File opened for modification C:\WINDOWS\WF3.DAT EliStarA.exe File opened for modification C:\WINDOWS\Branding\ShellBrd\Core1\sasdt1.KInf EliStarA.exe File opened for modification C:\WINDOWS\HH.HTT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Msntcs.job EliStarA.exe File opened for modification C:\WINDOWS\CMD.GDI EliStarA.exe File opened for modification C:\WINDOWS\disable.TXT EliStarA.exe File opened for modification C:\WINDOWS\HCF605.TXT EliStarA.exe File opened for modification C:\WINDOWS\Inf\ASYNCEQL.INF EliStarA.exe File opened for modification C:\WINDOWS\Task\BitGuard.job EliStarA.exe File opened for modification C:\WINDOWS\O.VBS EliStarA.exe File opened for modification C:\WINDOWS\Media\ssleay32.dll EliStarA.exe File opened for modification C:\WINDOWS\Tasks\FreeMonoLibrary.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms new library.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\WinNetworkTask.job EliStarA.exe File opened for modification C:\WINDOWS\notpad.exe EliStarA.exe File opened for modification C:\WINDOWS\GPC_666.CNF EliStarA.exe File opened for modification C:\WINDOWS\Resources\Themes\tjcm.cmn EliStarA.exe File opened for modification C:\WINDOWS\msbb_kyf.dat EliStarA.exe File opened for modification C:\WINDOWS\Tasks\OlacaritaUpdateTaskMachineUA.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\NativeLogger.job EliStarA.exe File opened for modification C:\WINDOWS\symantec.css EliStarA.exe File opened for modification C:\WINDOWS\Tasks\MsNetMonitor.job EliStarA.exe File opened for modification C:\WINDOWS\WF4.DAT EliStarA.exe File opened for modification C:\WINDOWS\pass.log EliStarA.exe File opened for modification C:\WINDOWS\WIASERVB.LOG EliStarA.exe File opened for modification C:\WINDOWS\WINHLP32.HLP EliStarA.exe File opened for modification C:\WINDOWS\javaupdate\update.dll EliStarA.exe File opened for modification C:\WINDOWS\csrss.exe.tmp EliStarA.exe File opened for modification C:\WINDOWS\HELP\HOSTS EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Home http service.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\VTTimer.job EliStarA.exe File opened for modification C:\WINDOWS\logo_symantec.gif EliStarA.exe File opened for modification C:\WINDOWS\TEMP.BAT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Test Task17.job EliStarA.exe File opened for modification C:\WINDOWS\IE-HOOK.TXT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Shell File Extensions.job EliStarA.exe File opened for modification C:\WINDOWS\System\setup87.inf EliStarA.exe File opened for modification C:\WINDOWS\Tasks\{15203F7B-31CF-3999-A824-6448E629E96C}.job EliStarA.exe File opened for modification C:\WINDOWS\SoftwareDistribution\intl.bat EliStarA.exe File opened for modification C:\WINDOWS\Tasks\DefragWinSysTask.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\DealPlyLiveUpdateTaskMachineUA.job EliStarA.exe File opened for modification C:\WINDOWS\Task\BrowserProtect.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Update4.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Power Saves.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\TimeEr.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows Network.job EliStarA.exe File opened for modification C:\WINDOWS\autorun.inf EliStarA.exe File opened for modification C:\WINDOWS\Tasks\svchost.job EliStarA.exe File opened for modification C:\WINDOWS\READ.TXT EliStarA.exe File opened for modification C:\WINDOWS\ZSMSCC16.INI EliStarA.exe File opened for modification C:\WINDOWS\Tasks\CmdValidate.job EliStarA.exe File opened for modification C:\WINDOWS\CLB.DLLBAK EliStarA.exe File opened for modification C:\WINDOWS\MEMTEST.TXT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32 EliStarA.exe File opened for modification C:\WINDOWS\Tasks\ÂÌ»¯.bat EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Flash.job EliStarA.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E813099D-5529-47F4-9B37-4AFAFCB00A43}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{63D0ED2C-B45B-4458-8B3B-60C69BBBD83C} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C4560D12-CE25-4A2E-A5D4-B5070FCBE282}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D60C571F-A2A9-42A4-A805-F820C0CB2EE0}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{5D79F641-C168-40DF-A32F-BACEA7509E75} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0D89DE71-3D99-4288-84DC-F18F1047A7D8}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{7473D292-B7BB-4F24-AE82-7E2CE94BB6A9} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D25F7446-4D36-4203-9EA5-5422B26FA9D0} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EBBFE27C-BDF0-11D2-BBE5-00609419F467}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0F8ECF4F-3646-4C3A-8881-8E138FFCAF70}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{74A49269-9779-48B4-A0E6-3A5AF2A3ADE6}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{9EAC0102-5E61-2312-BC2D-4D54434D5443} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{35845E32-35D9-46BB-9240-258AB96391C5} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{56F1D444-11BF-4879-A12B-79CF0177F038} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{08BED96E-5A7D-42E7-9049-D2FB4978BEBC} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{FFF5092F-7172-4018-827B-FA5868FB0478} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BFEF1779-0E92-45A1-BF5E-55991007F912} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{08EEC77A-D0BA-4C78-89CA-8609FF455AA3}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{2CF0B992-5EEB-4143-99C0-5297EF71F443} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{911F251E-34FD-465E-B6CE-DF00FF49A6BE}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DAF738F1-7E26-4960-B596-14AF7EDCFF31}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{FC0D62C2-9640-4AEB-A5D5-CF25DF11FA8C} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{733E9132-53CA-4C97-9AC9-145C4502FA20} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{B195B3B3-8A05-11D3-97A4-0004ACA6948E} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5321E378-FFAD-4999-8C62-03CA8155F0B3}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{7D435027-F646-4BF9-B2C5-0EF4940D5CA2} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{83A5F7B7-DC75-44CE-9195-264F41709FA9} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{FDA9BFC7-4ECD-43A0-AC1E-2E7DDE0C81B0}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{62D6DDA7-8FE9-47F1-B8E9-D1D0D3D9FF3A} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A982037A-5FA0-44BD-8BB8-BCE93EBBDFE8}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{29C5A3B6-9A8D-4FA0-B5AD-3E20F4AA5C00} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{CC8C8F4F-F2E8-404B-A43D-5CC57876A008} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{338DA9F8-3260-41FC-A66B-19B525185D1A}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0494D0DB-F8E0-41AD-92A3-14154ECE70AC}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{1FCA37BA-7259-4BF1-878B-A39FA83BFBBB} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{20EA9658-6BC3-4599-A87D-6371FE9295FC} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{6E785A53-AC5A-4F6A-A6E4-1B51FA4A0A09} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E271F4E9-D46E-4C7A-8608-AFDD4A87E582}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{201B9B37-848F-40BD-90EA-7B8F0AA89D6A}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{5D4831E0-5A7C-4A46-AFD5-A79AB8CE36C2} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{06A1F910-762A-4660-B534-55B82571851C} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{54018E98-10E3-46C6-9673-2999253F9C65} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{04B1E7D3-D4B7-48F2-AC4F-0D2555252A95}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6D797CF1-3D5E-4436-B891-0F12DEFBACA9}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{3D52425B-A0FE-4288-B1CB-24B3576E01CD} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{79A002FB-C126-462D-B4A7-81D6B42D1666} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{12BC3DAB-D768-4f05-88A5-FCC9099F5A0F}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{329EA303-E1F1-44B8-96E2-031DA4AF64A9}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BD04DAE2-8C1B-4CC5-9E06-22DE05C2EDA0} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{F9302BA7-C816-4DF0-85CA-85DC3DE3AD05} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BF0A1FF4-BBAF-487f-BC85-A24EF8F443A8} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{35A5B43B-CB8A-49CA-A9F4-D3B308D2E3CC}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{7A81DF49-1DB8-4DB4-B070-AD6758ECBA2A} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{B364AADE-53FA-4779-8643-D833B8969F10} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{C4B51C1A-A650-4D29-BCF8-5F860AE42DFD} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D62A2513-0A8B-44F8-8479-3AFFAFC5FF82} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{90A22E29-FE54-447F-B5ED-6091733AB22F}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{81CFC095-AC7A-4B6C-9EBF-9B353A7A7EE2} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B6EBB453-80AD-463C-B6BC-4C8DC30E033F}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{00000000-F09C-02B4-6EC2-AD0300000000} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{06CAD548-14DD-4FA3-9EA9-05F83C18CBD7} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{0CF4A06D-F787-4D21-B273-076933F3F629} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A710731F-9C7A-45AD-9B33-709A82A5C8A1}\Compatibility Flags = "1024" EliStarA.exe -
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "cmdfile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "comfile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "regfile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "Regedit.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jsfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\PersistentHandler EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "JSFile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"%1\" /S" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbsfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "%SystemRoot%\\system32\\mmc.exe \"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\ = "htafile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbefile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htc\Content Type = "text/x-component" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\Content Type = "application/hta" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\about EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.com EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "batfile" EliStarA.exe -
Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe 4720 EliStarA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4720 EliStarA.exe Token: SeRestorePrivilege 4720 EliStarA.exe Token: SeShutdownPrivilege 4720 EliStarA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4720 EliStarA.exe 4720 EliStarA.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 4720 wrote to memory of 3976 4720 EliStarA.exe 83 PID 4720 wrote to memory of 3976 4720 EliStarA.exe 83 PID 4720 wrote to memory of 2808 4720 EliStarA.exe 126 PID 4720 wrote to memory of 2808 4720 EliStarA.exe 126 PID 4720 wrote to memory of 2776 4720 EliStarA.exe 121 PID 4720 wrote to memory of 2776 4720 EliStarA.exe 121 PID 4720 wrote to memory of 2724 4720 EliStarA.exe 120 PID 4720 wrote to memory of 2724 4720 EliStarA.exe 120 PID 4720 wrote to memory of 3016 4720 EliStarA.exe 119 PID 4720 wrote to memory of 3016 4720 EliStarA.exe 119 PID 4720 wrote to memory of 2236 4720 EliStarA.exe 84 PID 4720 wrote to memory of 2236 4720 EliStarA.exe 84 PID 4720 wrote to memory of 1960 4720 EliStarA.exe 118 PID 4720 wrote to memory of 1960 4720 EliStarA.exe 118 PID 4720 wrote to memory of 2140 4720 EliStarA.exe 116 PID 4720 wrote to memory of 2140 4720 EliStarA.exe 116 PID 4720 wrote to memory of 4576 4720 EliStarA.exe 114 PID 4720 wrote to memory of 4576 4720 EliStarA.exe 114 PID 4720 wrote to memory of 4616 4720 EliStarA.exe 112 PID 4720 wrote to memory of 4616 4720 EliStarA.exe 112 PID 4720 wrote to memory of 4876 4720 EliStarA.exe 111 PID 4720 wrote to memory of 4876 4720 EliStarA.exe 111 PID 4720 wrote to memory of 1676 4720 EliStarA.exe 109 PID 4720 wrote to memory of 1676 4720 EliStarA.exe 109 PID 4720 wrote to memory of 3492 4720 EliStarA.exe 108 PID 4720 wrote to memory of 3492 4720 EliStarA.exe 108 PID 4720 wrote to memory of 2488 4720 EliStarA.exe 106 PID 4720 wrote to memory of 2488 4720 EliStarA.exe 106 PID 4720 wrote to memory of 224 4720 EliStarA.exe 105 PID 4720 wrote to memory of 224 4720 EliStarA.exe 105 PID 4720 wrote to memory of 2540 4720 EliStarA.exe 104 PID 4720 wrote to memory of 2540 4720 EliStarA.exe 104 PID 4720 wrote to memory of 4360 4720 EliStarA.exe 103 PID 4720 wrote to memory of 4360 4720 EliStarA.exe 103 PID 4720 wrote to memory of 3256 4720 EliStarA.exe 102 PID 4720 wrote to memory of 3256 4720 EliStarA.exe 102 PID 4720 wrote to memory of 1896 4720 EliStarA.exe 100 PID 4720 wrote to memory of 1896 4720 EliStarA.exe 100 PID 4720 wrote to memory of 4772 4720 EliStarA.exe 99 PID 4720 wrote to memory of 4772 4720 EliStarA.exe 99 PID 4720 wrote to memory of 1836 4720 EliStarA.exe 98 PID 4720 wrote to memory of 1836 4720 EliStarA.exe 98 PID 4720 wrote to memory of 2868 4720 EliStarA.exe 97 PID 4720 wrote to memory of 2868 4720 EliStarA.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"1⤵
- Modifies system executable filetype association
- Adds policy Run key to start application
- Drops file in Drivers directory
- Sets service image path in registry
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\*.*" /a /q"2⤵PID:3976
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}""2⤵PID:2236
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.usb"2⤵PID:2868
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.usb\*.* /a /q"2⤵PID:1836
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.ini"2⤵PID:4772
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.ini\*.* /a /q"2⤵PID:1896
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.sys"2⤵PID:3256
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.sys\*.* /a /q"2⤵PID:4360
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}""2⤵PID:2540
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}\*.*" /a /q"2⤵PID:224
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:2488
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:3492
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}""2⤵PID:1676
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}\*.*" /a /q"2⤵PID:4876
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}""2⤵PID:4616
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}\*.*" /a /q"2⤵PID:4576
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}""2⤵PID:2140
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\*.*" /a /q"2⤵PID:1960
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}\*.*" /a /q"2⤵PID:3016
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:2724
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:2776
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}""2⤵PID:2808
-