Analysis
-
max time kernel
41s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
20-02-2023 23:48
Behavioral task
behavioral1
Sample
EliStarA.exe
Resource
win7-20230220-en
dmalockerhawkeyelockylocky_osirismodiloaderwannacrydiscoverykeyloggerpersistenceransomwarespywarestealertrojanupxworm
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
EliStarA.exe
Resource
win10v2004-20230220-en
dmalockerhawkeyelockylocky_osirismodiloaderwannacrydiscoverykeyloggerpersistenceransomwarespywarestealertrojanupxworm
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
EliStarA.exe
-
Size
1.7MB
-
MD5
6b8dcb09a6f8e836b5dcc600d11c6223
-
SHA1
b0a1582b9e9871064afae5cb6b1d369599506763
-
SHA256
11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
-
SHA512
feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
-
SSDEEP
49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E
Malware Config
Signatures
-
DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-21 004847) EliStarA.exe File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver2.txt EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-21 004847) EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\ISPUPDRV.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\config.json EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\config.json EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver2.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\ISPUPDRV.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" EliStarA.exe -
Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rootvimkvddoarv.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Explorer.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\(Vacío).lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\audiodga.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mfsrcsnk.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\drhd.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mp3.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asdqw.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdcgjhjyuyihdastagghejh.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AZzzVJXXFY.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autopilot.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\live.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\plbns.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\outlookupdatings.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gBWXXQuzYx.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\chromee.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cbvredgs.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows update.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hdry.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\filez8.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Regmonstd.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbcdfxc.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\audiodgc.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.ini.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cxcvredgs.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\refsutil.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\thistime.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\explor.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\winlogin.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VCqFv.com.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\visualPrint.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xckycixgych.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gtdddsssqyt.js EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cvbdfgsd.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hwC1305I.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\antomarvis.exe.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HpuEtzbXyw.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fgisdp.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BbIGzz.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\(Vacmo).lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\expls.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\tsig.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\TestLink.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gato.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xemfpqyipxgmokm.eu.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\qwrtd.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ymbWet.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ArchivioAmatoriali.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Download.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\whatsapp.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AudioHD.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\uniplat.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wzsdfr.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shrpubw.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wscsvc.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ofiyh.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jkzoKD.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\os.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hqghumeaylnlf.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.url EliStarA.exe -
resource yara_rule behavioral1/memory/1192-54-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral1/memory/1192-61-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral1/memory/1192-64-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral1/memory/1192-65-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral1/memory/1192-68-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral1/memory/1192-71-0x0000000000400000-0x00000000005BF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\WINDOWS\SYSTEM32\AUTORUN.INF EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\AUTORUN.INF EliStarA.exe File opened for modification C:\WINDOWS\autorun.inf EliStarA.exe File opened for modification C:\autorun.inf EliStarA.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Download http service EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\AUTORUN.I EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\dcupdate.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\MsNetMonitor EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Shell File Extensions EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Ms speed internet library EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\tty.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WARNING.HTML EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Nafnifas EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\TEUER.JAR EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\name EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Install\LOGG.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\ICONG.ICO EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\LSNSS.EXE EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tempxyz.dll EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\wfyoot.exe EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Windows Network EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\___u EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\WINLOG2.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\werwqerweqrwe EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Windows Power Saves EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SQL_2QINGD.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\DLL1.tmp EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\zdengineOff.ini EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SQLPASS.DIC EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Clean Master EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\netcloud free disk EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\services update EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Windows Shell OneDrive Extensions EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\ENVIADOS.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\sqtvvs.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\MsLogExpert EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\MsNetValidator EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Windows Net Core EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\VERSION.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\mjlooy.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\EJECUTOR.BAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Home lan application EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\RdpSaUacHelper EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\UpdateWuaucltHelper EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\MODEL.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\HX1.BAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Speed lan library EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\MSNAV32.AX EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\SPEC.FNE EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Netframework EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\CRT.DAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\spec EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\hort EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\bios_setup1192.txt EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\EMM.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\svcupdater EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SQL_1.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\AUTORUN.I EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Time Trigger Task EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\CompFit Application EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\DMLCONF.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\INTERNET.FNE EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Updates\FTNygAhcwbW EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Bot EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Windows .Net core library EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SB.HTM EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\EMM.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Windows Defender host EliStarA.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\Internet Explorer\Windows Update.exe.config EliStarA.exe File opened for modification C:\Program Files\log.txt EliStarA.exe File opened for modification C:\Program Files\Outlook Express\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\NetMeeting\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\X.BMP EliStarA.exe File opened for modification C:\Program Files\Common Files\System\Uninstall\Uninstall A360.lnk EliStarA.exe File opened for modification C:\Program Files\Common Files\Systems\PINKS.DLL EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exex EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.ex_ EliStarA.exe File opened for modification C:\Program Files\Movie Maker\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\JustClicking\home.bat EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\DMLCONF.DAT EliStarA.exe File opened for modification C:\Program Files\installESP.log EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\JS.MUI EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exe.config EliStarA.exe File opened for modification C:\Program Files\Messenger\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ACPI.VXD EliStarA.exe File opened for modification C:\Program Files\Assembly\System.exe.config EliStarA.exe File opened for modification C:\Program Files\WebRebates4\Websrebates\Webtrebates\toprC0.htm EliStarA.exe File opened for modification C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe EliStarA.exe File opened for modification C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml EliStarA.exe File opened for modification C:\Program Files\Messenger Plus! Live\Scripts\hola\hola.js EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ONLO0R.OBK EliStarA.exe File opened for modification C:\Program Files\VERSION.TXT EliStarA.exe File opened for modification C:\Program Files\Lycos\Sidesearch\OFFLINE.HTM EliStarA.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\Tasks\Windows directory manager.job EliStarA.exe File opened for modification C:\WINDOWS\CLB.DLLBAK EliStarA.exe File opened for modification C:\WINDOWS\email.log EliStarA.exe File opened for modification C:\WINDOWS\logo_home.gif EliStarA.exe File opened for modification C:\WINDOWS\syskey2i.drv EliStarA.exe File opened for modification C:\WINDOWS\Tasks\DefragWinSysTask.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms visual extension.job EliStarA.exe File opened for modification C:\WINDOWS\Inf\farmmext.inf EliStarA.exe File opened for modification C:\WINDOWS\HCF605.TXT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Shell File Extensions.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\BLD93115RWR.job EliStarA.exe File opened for modification C:\WINDOWS\Drivers\PLUGIN.DAT EliStarA.exe File opened for modification C:\WINDOWS\tasksche.exe EliStarA.exe File opened for modification C:\WINDOWS\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Gpu Tools.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows Network.job EliStarA.exe File opened for modification C:\WINDOWS\SoftwareDistribution\grim.ime EliStarA.exe File opened for modification C:\WINDOWS\System\setup87.inf EliStarA.exe File opened for modification C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B} EliStarA.exe File opened for modification C:\WINDOWS\GPC_666.CNF EliStarA.exe File opened for modification C:\WINDOWS\nav_help-over.gif EliStarA.exe File opened for modification C:\WINDOWS\Tasks\MiscfostNsi.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\AudibleFree.job EliStarA.exe File opened for modification C:\WINDOWS\180ax.log EliStarA.exe File opened for modification C:\WINDOWS\a776a8.js EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ions2.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\TimeEr.job EliStarA.exe File opened for modification C:\WINDOWS\windowsXP_masthead_ltr.gif EliStarA.exe File opened for modification C:\WINDOWS\SoftwareDistribution\msletni.ime EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Cache System Extension.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\program.job EliStarA.exe File opened for modification C:\WINDOWS\WF4.DAT EliStarA.exe File opened for modification C:\WINDOWS\WINHLP32.HLP EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Debitumenize.job EliStarA.exe File opened for modification C:\WINDOWS\Task\Browser Manager.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\WindowsUpdate2.job EliStarA.exe File opened for modification C:\WINDOWS\Setup\Extensionm.dll EliStarA.exe File opened for modification C:\WINDOWS\Tasks\services update.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows Power saves tools for windows.job EliStarA.exe File opened for modification C:\WINDOWS\Media\ssleay32.dll EliStarA.exe File opened for modification C:\WINDOWS\_ID.DAT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\{810401E2-DDE0-454e-B0E2-AA89C9E5967C}.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\BrowserStorage.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\MNU Net libraries.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Power Saves.job EliStarA.exe File opened for modification C:\WINDOWS\Debug\ddid EliStarA.exe File opened for modification C:\WINDOWS\Tasks\hackshen.vbs EliStarA.exe File opened for modification C:\WINDOWS\Tasks\wow64.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Free Advanced Tuneup utilities for Windows.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms net.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\System Network Extensions.job EliStarA.exe File opened for modification C:\WINDOWS\System\MOUSE.DLL EliStarA.exe File opened for modification C:\WINDOWS\3.VBS EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Capite7.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms Cloud Network.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Shell Database Extensions.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\WinInform.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\MsLogMonitor.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Task Gpu health.job EliStarA.exe File opened for modification C:\WINDOWS\salmau.dat EliStarA.exe File opened for modification C:\WINDOWS\NIGZSS.TXT EliStarA.exe File opened for modification C:\WINDOWS\Branding\ShellBrd\Core1\sasdt1.bak EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows_Update.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Drivers Update.job EliStarA.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{53FCF358-5323-11D0-A864-0000B43699FC} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F86B11F3-0CE1-475F-9541-5329BF7B3597}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{196B9CB5-4C83-46F7-9B06-9672ECD9D99B} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{832BEBED-C3DA-4534-A2C2-B2FFF220C820}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1515B906-999A-48F3-8BF4-B7EC61BF5B38}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{AF0C0AA7-AFBA-46a0-A394-B1E1345FD936} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{A98D0065-7326-41B5-B8D9-C5B692CDB82F} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D0DC2547-DF58-4CF2-8FA2-25DEE29426F6} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D3B3C51E-8D11-4667-85B9-0930F519BED7}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{008F6853-9CB4-41C5-A950-39D55E5E06BA} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{0962DA67-DB64-465C-8CD7-CBB357CAF825} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{4AA55E8C-2C19-4F3A-91EC-43B6DF937C4F} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E5646F36-145E-4F1D-B6D1-87C5EFC5BA1C}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{B364AADE-53FA-4779-8643-D833B8969F10} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{0AFEA888-B97B-4EDE-AC47-1FEE31D5CEE5}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{1D6711C8-7154-40BB-8380-3DEA45B69CBF} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{D212259D-4648-4903-9FBD-02E88785D33C} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E0EA1F31-B58F-47E8-A185-20C52DF9F168}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{62649F82-DA45-4665-AB6F-4A88A8DF0FCC} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{1EBFF80C-EF1E-49A2-8F43-022354EF17CF} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{6BBA5E8C-6641-420C-896F-23D338C801A6}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{DDE2C74F-58CC-4d71-8CE1-09DEBB8CFB78} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C218BC1-B339-40DF-8346-792D2DBAFFB5}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{9387B8B2-5508-11DE-8729-C56F55D89593} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{C2015CE4-4C73-6EFC-92DC-06077ACDFC13} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{06F20C1A-4811-4c73-A114-792ED70F2CAD} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1631550F-191D-4826-B069-D9439253D926}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{7802C010-19E4-42AE-BFE5-B244B488B32F}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{39D67F39-6F48-438A-80A2-F86FE363C215} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{01F44A8A-8C97-4325-A378-76E68DC4AB2E}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B5533239-2826-4FA8-BCFB-A9A44008FF4B}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{CC90CDA0-74A0-45B4-80EF-D89CA8C249B8} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{22AE4869-4E8A-457B-9F8F-CC340A5A450B}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{FC2493D6-A673-49FE-A2EE-EFE03E95C27C} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{483CC496-D041-4545-8D9E-2D64294F97B2} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{3A4E6FF3-BF59-446E-9DC8-731BCE2F349A} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{564FFB73-9EEF-4969-92FA-5FC4A92E2C2A}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{F99F647F-24D3-4793-B8A7-EDD2C9A88609} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{AF7FCAFB-9FDB-4F5E-BAC6-68BDEE61D6C6}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DF9A99CF-49C6-4E3E-B668-498B718FD313}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{07B18EA1-A523-4961-B6BB-170DE4475CCA} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{13B5C450-C43E-4531-B12E-97779B346B5F} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D797AD6C-6447-4DB4-91D0-090344408E72}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{ADA4AB54-F034-41A4-9A68-95DF06976B68}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{36F053A0-E844-44A1-BB60-A911E581877E} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{36A72DF8-A1EF-496A-BDBC-FEB4BEEDE52D} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{5D50D513-E136-4F9F-B610-C7805E5F2491} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{F7999166-FDE6-49DA-9AFC-1F6A79E9D1F2} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{66B90ADB-0BE3-40AE-8680-84A6F0577CA0} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{2F8C6D1F-1995-40EF-9CAA-3ECC40F19A87} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{674855C3-B0B1-4413-9BB4-BFA6A9B5257B}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{998DAE3E-7D4F-4952-A71F-467D8FE64407} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{07B18EA9-A523-4961-B6BB-170DE4475CCA} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{274C0420-EBE0-4F1D-B473-EDD1AA9B85DD} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{827DC836-DD9F-4A68-A602-5812EB50A834} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{88CA7B26-F60D-444A-9A5B-00CFF12BD4DC}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A798E2B4-B6A0-4B96-8C53-8EC7A3B0895A}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{182B90A3-F372-438A-800C-6814B4DE417B} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{53D2B243-C8DF-460C-A3FF-745870147415}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A55581DC-2CDB-4089-8878-71A080B22342}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{F5938714-BD46-408A-9842-4058206D37E3} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{EA20F195-32DA-4bd6-B348-FD01FC7D3D5A}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{47EFD4AD-CB46-4549-B24B-CEE415394C56} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{4D25FB7A-8902-4291-960E-9ADA051CFBBF}\Compatibility Flags = "1024" EliStarA.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "Regedit.exe \"%1\"" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.com EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\Content Type = "application/hta" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile\ShellNew EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "batfile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "JSFile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "%SystemRoot%\\system32\\mmc.exe \"%1\" %*" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "cmdfile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "comfile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbefile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mpf\MediaPackageFile EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "regfile" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BF068D0-B735-11D3-B2CF-00500489D6A3}\ProxyStubClsid32 EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BF068D0-B735-11D3-B2CF-00500489D6A3}\ProxyStubClsid EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BF068D0-B735-11D3-B2CF-00500489D6A3} EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3} EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\ProxyStubClsid32 EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\ProxyStubClsid EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jsfile\shell\open\command EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\PersistentHandler EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\about EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9BF068D0-B735-11D3-B2CF-00500489D6A3}\TypeLib EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbsfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\ = "htafile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htc\Content Type = "text/x-component" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"%1\" /S" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54F37842-CDD7-11D3-B2D4-00500489D6A3}\TypeLib EliStarA.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe 1192 EliStarA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1192 EliStarA.exe Token: SeRestorePrivilege 1192 EliStarA.exe Token: SeShutdownPrivilege 1192 EliStarA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1192 EliStarA.exe 1192 EliStarA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1192 wrote to memory of 1184 1192 EliStarA.exe 28 PID 1192 wrote to memory of 1184 1192 EliStarA.exe 28 PID 1192 wrote to memory of 1184 1192 EliStarA.exe 28 PID 1192 wrote to memory of 1184 1192 EliStarA.exe 28 PID 1192 wrote to memory of 768 1192 EliStarA.exe 29 PID 1192 wrote to memory of 768 1192 EliStarA.exe 29 PID 1192 wrote to memory of 768 1192 EliStarA.exe 29 PID 1192 wrote to memory of 768 1192 EliStarA.exe 29 PID 1192 wrote to memory of 332 1192 EliStarA.exe 32 PID 1192 wrote to memory of 332 1192 EliStarA.exe 32 PID 1192 wrote to memory of 332 1192 EliStarA.exe 32 PID 1192 wrote to memory of 332 1192 EliStarA.exe 32 PID 1192 wrote to memory of 868 1192 EliStarA.exe 31 PID 1192 wrote to memory of 868 1192 EliStarA.exe 31 PID 1192 wrote to memory of 868 1192 EliStarA.exe 31 PID 1192 wrote to memory of 868 1192 EliStarA.exe 31 PID 1192 wrote to memory of 1516 1192 EliStarA.exe 37 PID 1192 wrote to memory of 1516 1192 EliStarA.exe 37 PID 1192 wrote to memory of 1516 1192 EliStarA.exe 37 PID 1192 wrote to memory of 1516 1192 EliStarA.exe 37 PID 1192 wrote to memory of 596 1192 EliStarA.exe 35 PID 1192 wrote to memory of 596 1192 EliStarA.exe 35 PID 1192 wrote to memory of 596 1192 EliStarA.exe 35 PID 1192 wrote to memory of 596 1192 EliStarA.exe 35 PID 1192 wrote to memory of 1928 1192 EliStarA.exe 36 PID 1192 wrote to memory of 1928 1192 EliStarA.exe 36 PID 1192 wrote to memory of 1928 1192 EliStarA.exe 36 PID 1192 wrote to memory of 1928 1192 EliStarA.exe 36 PID 1192 wrote to memory of 548 1192 EliStarA.exe 65 PID 1192 wrote to memory of 548 1192 EliStarA.exe 65 PID 1192 wrote to memory of 548 1192 EliStarA.exe 65 PID 1192 wrote to memory of 548 1192 EliStarA.exe 65 PID 1192 wrote to memory of 1988 1192 EliStarA.exe 63 PID 1192 wrote to memory of 1988 1192 EliStarA.exe 63 PID 1192 wrote to memory of 1988 1192 EliStarA.exe 63 PID 1192 wrote to memory of 1988 1192 EliStarA.exe 63 PID 1192 wrote to memory of 804 1192 EliStarA.exe 62 PID 1192 wrote to memory of 804 1192 EliStarA.exe 62 PID 1192 wrote to memory of 804 1192 EliStarA.exe 62 PID 1192 wrote to memory of 804 1192 EliStarA.exe 62 PID 1192 wrote to memory of 780 1192 EliStarA.exe 39 PID 1192 wrote to memory of 780 1192 EliStarA.exe 39 PID 1192 wrote to memory of 780 1192 EliStarA.exe 39 PID 1192 wrote to memory of 780 1192 EliStarA.exe 39 PID 1192 wrote to memory of 844 1192 EliStarA.exe 40 PID 1192 wrote to memory of 844 1192 EliStarA.exe 40 PID 1192 wrote to memory of 844 1192 EliStarA.exe 40 PID 1192 wrote to memory of 844 1192 EliStarA.exe 40 PID 1192 wrote to memory of 1660 1192 EliStarA.exe 41 PID 1192 wrote to memory of 1660 1192 EliStarA.exe 41 PID 1192 wrote to memory of 1660 1192 EliStarA.exe 41 PID 1192 wrote to memory of 1660 1192 EliStarA.exe 41 PID 1192 wrote to memory of 1412 1192 EliStarA.exe 42 PID 1192 wrote to memory of 1412 1192 EliStarA.exe 42 PID 1192 wrote to memory of 1412 1192 EliStarA.exe 42 PID 1192 wrote to memory of 1412 1192 EliStarA.exe 42 PID 1192 wrote to memory of 756 1192 EliStarA.exe 44 PID 1192 wrote to memory of 756 1192 EliStarA.exe 44 PID 1192 wrote to memory of 756 1192 EliStarA.exe 44 PID 1192 wrote to memory of 756 1192 EliStarA.exe 44 PID 1192 wrote to memory of 880 1192 EliStarA.exe 43 PID 1192 wrote to memory of 880 1192 EliStarA.exe 43 PID 1192 wrote to memory of 880 1192 EliStarA.exe 43 PID 1192 wrote to memory of 880 1192 EliStarA.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"1⤵
- Modifies system executable filetype association
- Adds policy Run key to start application
- Drops file in Drivers directory
- Sets service image path in registry
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\*.*" /a /q"2⤵PID:1184
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}""2⤵PID:768
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:868
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:332
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}""2⤵PID:596
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\*.*" /a /q"2⤵PID:1928
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}\*.*" /a /q"2⤵PID:1516
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}\*.*" /a /q"2⤵PID:780
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}""2⤵PID:844
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:1660
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:1412
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}""2⤵PID:880
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}\*.*" /a /q"2⤵PID:756
-
-
C:\Windows\system32\cmd.execmd /c "del \\.\C:\con.ini\*.* /a /q"2⤵PID:1624
-
-
C:\Windows\system32\cmd.execmd /c "del \\.\C:\con.usb\*.* /a /q"2⤵PID:1936
-
-
C:\Windows\system32\cmd.execmd /c "rd \\.\C:\con.usb"2⤵PID:1820
-
-
C:\Windows\system32\cmd.execmd /c "rd \\.\C:\con.ini"2⤵PID:1844
-
-
C:\Windows\system32\cmd.execmd /c "rd \\.\C:\con.sys"2⤵PID:1668
-
-
C:\Windows\system32\cmd.execmd /c "del \\.\C:\con.sys\*.* /a /q"2⤵PID:1596
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}""2⤵PID:804
-
-
C:\Windows\system32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}\*.*" /a /q"2⤵PID:1988
-
-
C:\Windows\system32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}""2⤵PID:548
-