Analysis
-
max time kernel
55s -
max time network
106s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
20-02-2023 23:48
Behavioral task
behavioral1
Sample
EliStarA.exe
Resource
win7-20230220-en
dmalockerhawkeyelockylocky_osirismodiloaderwannacrydiscoverykeyloggerpersistenceransomwarespywarestealertrojanupxworm
windows7-x64
24 signatures
150 seconds
Behavioral task
behavioral2
Sample
EliStarA.exe
Resource
win10v2004-20230220-en
dmalockerhawkeyelockylocky_osirismodiloaderwannacrydiscoverykeyloggerpersistenceransomwarespywarestealertrojanupxworm
windows10-2004-x64
24 signatures
150 seconds
General
-
Target
EliStarA.exe
-
Size
1.7MB
-
MD5
6b8dcb09a6f8e836b5dcc600d11c6223
-
SHA1
b0a1582b9e9871064afae5cb6b1d369599506763
-
SHA256
11aaa12e58f39f192b4f66e56cd0e343d73b69a48dc77a6dfb936483de120152
-
SHA512
feb8bd04778b29efc9b0128dbfd9562368eb825a560dc610abed6a73de1dc7bd33e5e198b439b36828d0a66d4657e354d4a65646141ad3425bed6fd74cb7fcae
-
SSDEEP
49152:lJCDpfmhr2qIhBCwb8lIgwylCJHXv5y7lE8X:6HB/b8KgZA5E
Malware Config
Signatures
-
DMA Locker
Ransomware family with some advanced features, like encryption of unmapped network shares.
-
Locky
Ransomware strain released in 2016, with advanced features like anti-analysis.
-
Locky (Osiris variant)
Variant of the Locky ransomware seen in the wild since early 2017.
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies system executable filetype association 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Prueba = "Ok" EliStarA.exe -
Drops file in Drivers directory 22 IoCs
description ioc Process File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver2.txt EliStarA.exe File created C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-21 004853) EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\RVDPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\config.json EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\ver2.txt EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\str.sys EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\Inf\SOCFG.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\ISPUPDRV.SYS EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\ver.txt EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\drivers\config.json EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\drivers\etc\Hosts(2023-02-21 004853) EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\AUTORUN.BAK EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\DETPORT.SYS EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Drivers\ISPUPDRV.SYS EliStarA.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "%SystemRoot%\\System32\\svchost.exe -k netsvcs" EliStarA.exe -
Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\oyjf.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xithe.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecurityHost.exe.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sgih.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BxjUOFQUZX.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system32helper.js EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ntry.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbs.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\config.vbe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PasswordOnWakeSettingFlyout.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdchange.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rqw.vbe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\hi.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bmnfge.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbnme.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\mighr.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbfdcv.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\windows update.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sdfnme.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\shrpubw.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\w7Auwv44gzhC6Njn.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3R9HDJy9.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\audiodialog.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\asspp.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\bAUnSdlCkw.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JHGUJYGBIG,UKHI.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\aadcloudap.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gBWXXQuzYx.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbcdfxc.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ddr.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\el homa.URL EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LEeg6AxO.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\browseui.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\otgwsf.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jK53O26n.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vbftyuj.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ertsdvb.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Program.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Gato.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\reload1.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\htjdd.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IF YOU WANT TO GET ALL YOUR FILES BACK, PLEASE READ THIS.TXT EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ksea.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Document.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\JOJO.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gn46.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DW_START.LNK EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Wr9RqAY2.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\IMEPADSV.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Webhost.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DpiScaling.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\exploerss.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\usvc32.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vnvhbjyyqigwezh.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vol.vbe EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\kwrtd.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Info.hta EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\csrss.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AB8EzBzZ.url EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\web.vbs EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\convert.lnk EliStarA.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Zentom System Guard.lnk EliStarA.exe -
resource yara_rule behavioral2/memory/548-133-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/548-140-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/548-141-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/548-142-0x0000000000400000-0x00000000005BF000-memory.dmp upx behavioral2/memory/548-145-0x0000000000400000-0x00000000005BF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Prueba = "Ok" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Prueba = "Ok" EliStarA.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\autorun.inf EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\AUTORUN.INF EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\AUTORUN.INF EliStarA.exe File opened for modification C:\WINDOWS\autorun.inf EliStarA.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\EAPI.FNE EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\HEURICCOMMAND.BAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\nbetwinds EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\___e EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\___u EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\_ID.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\AVG32XL.KDX EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\NORUNS.REG EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\nbveek.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\EAPI.FNE EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\DRVUPD.INF EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Ions2 EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\s.ico EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\hbilop.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Milieukravene EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\images EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\MODEL.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Windows .Net library core EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\HomeGroupProvider EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\ICON.ICO EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\SpywareWarning.mht EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\abengine.ini EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\blfte.exe EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\SVDHALP.EXE.INI EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\TaskForms1.0 EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Windows .Net core library EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\WinComService.exe EliStarA.exe File opened for modification C:\Windows\System32\Winsh320 EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\PowerControl LG EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\{18FD2003-7401-4463-B772-6843E703F734} EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Ms speed internet library EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Task Gpu update EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\WPA Service EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\saieau.dat EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\CSRSC EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\.Identifier EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SQLPASS.DIC EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\SQL_3.DAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Nanos EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Nafdnasia EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\images EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\{18FD2003-7401-4463-B772-6843E703F734} EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\P2.INI EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\WindowsInput.exe.config EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Encrypter EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\babfiv.sys EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\TEUER.JAR EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\NlsLexicons00mmx.dll EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\DLL1.tmp EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Nafifas EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Blanktegn7 EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Ms Cloud Lan EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\System Health Application EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\HEURICCOMMAND.BAT EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\NetworkTask EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\WPA Service EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\WINK.DLL EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Adasdsadas3id EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\Tasks\Ms Cloud Lan EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\Visual Extensions EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\SYS.REG EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\Tasks\NativeLogger EliStarA.exe File opened for modification C:\WINDOWS\SysWOW64\INTERNET.FNE EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32\RUNONCE.TM_ EliStarA.exe -
Drops file in Program Files directory 25 IoCs
description ioc Process File opened for modification C:\Program Files\Messenger Plus! Live\Scripts\hola\hola.js EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\JS.MUI EliStarA.exe File opened for modification C:\Program Files\log.txt EliStarA.exe File opened for modification C:\Program Files\Movie Maker\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\NetMeeting\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe EliStarA.exe File opened for modification C:\Program Files\Mozilla Firefox\searchplugins\fcmdSrch.xml EliStarA.exe File opened for modification C:\Program Files\installESP.log EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\Windows Update.exe.config EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.ex_ EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ACPI.VXD EliStarA.exe File opened for modification C:\Program Files\Assembly\System.exe.config EliStarA.exe File opened for modification C:\Program Files\Common Files\Systems\PINKS.DLL EliStarA.exe File opened for modification C:\Program Files\Outlook Express\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\Messenger\KLOG.DAT EliStarA.exe File opened for modification C:\Program Files\X.BMP EliStarA.exe File opened for modification C:\Program Files\JustClicking\home.bat EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\DMLCONF.DAT EliStarA.exe File opened for modification C:\Program Files\Common Files\System\Uninstall\Uninstall A360.lnk EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exe.config EliStarA.exe File opened for modification C:\Program Files\Adobe\pdf.exex EliStarA.exe File opened for modification C:\Program Files\Internet Explorer\ONLO0R.OBK EliStarA.exe File opened for modification C:\Program Files\VERSION.TXT EliStarA.exe File opened for modification C:\Program Files\Lycos\Sidesearch\OFFLINE.HTM EliStarA.exe File opened for modification C:\Program Files\WebRebates4\Websrebates\Webtrebates\toprC0.htm EliStarA.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\NIGZSS.TXT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Betvingelsernes7.job EliStarA.exe File opened for modification C:\WINDOWS\WINLOG EliStarA.exe File opened for modification C:\WINDOWS\RARARC.BAT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Shell Applications Extension.job EliStarA.exe File opened for modification C:\WINDOWS\BM9b5ae91d.txt EliStarA.exe File opened for modification C:\WINDOWS\Tasks\OlacaritaUpdateTaskMachineCore.job EliStarA.exe File opened for modification C:\WINDOWS\tasksche.exe EliStarA.exe File opened for modification C:\WINDOWS\LDLIST.TXT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms visual extension.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\net rest application.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\WinDotNet.job EliStarA.exe File opened for modification C:\WINDOWS\PSKT.INI EliStarA.exe File opened for modification C:\WINDOWS\EXPIORER.EXE EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ions2.job EliStarA.exe File opened for modification C:\WINDOWS\System\SYSTEM.VBS EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Stream application.job EliStarA.exe File opened for modification C:\WINDOWS\qeriuwjhrf EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Crome.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Rosinbrdet5.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows Power Saves.job EliStarA.exe File opened for modification C:\WINDOWS\artmmp.ini EliStarA.exe File opened for modification C:\WINDOWS\DIDUSEEKER03.TXR EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms libraries.job EliStarA.exe File opened for modification C:\WINDOWS\BOOT.BAT EliStarA.exe File opened for modification C:\WINDOWS\SYSTEM32 EliStarA.exe File opened for modification C:\WINDOWS\SRCH.REG EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Microsoft System Protect.job EliStarA.exe File opened for modification C:\WINDOWS\syskey2i.drv EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Drivers Update.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Windows .Net core library.job EliStarA.exe File opened for modification C:\WINDOWS\JEJEKAT.TXT EliStarA.exe File opened for modification C:\WINDOWS\Branding\ShellBrd\Core1\sasdt1.bak EliStarA.exe File opened for modification C:\WINDOWS\Tasks\{15203F7B-31CF-3999-A824-6448E629E96C}.job EliStarA.exe File opened for modification C:\WINDOWS\AHNRPTA.EXE EliStarA.exe File opened for modification C:\WINDOWS\AutoRunApp.vbs EliStarA.exe File opened for modification C:\WINDOWS\ROX.ROXROX EliStarA.exe File opened for modification C:\WINDOWS\DEFAULT.CSS EliStarA.exe File opened for modification C:\WINDOWS\Resources\Themes\icsys.icn EliStarA.exe File opened for modification C:\WINDOWS\MsSkinner\MSBACKUP.DAT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Net libraries.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\BrowserDatStorage.job EliStarA.exe File opened for modification C:\WINDOWS\Branding\ShellBrd\Core1\sasdt1.KInf EliStarA.exe File opened for modification C:\WINDOWS\READ.TXT EliStarA.exe File opened for modification C:\WINDOWS\OLGROS.BAT EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Miscfost.job EliStarA.exe File opened for modification C:\WINDOWS\Crmans.dat EliStarA.exe File opened for modification C:\WINDOWS\email.log EliStarA.exe File opened for modification C:\WINDOWS\System\gzip.exe EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms Cloud Disk.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Ms new library.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Win Direct Tools.job EliStarA.exe File opened for modification C:\WINDOWS\BM9b5ae91d.xml EliStarA.exe File opened for modification C:\WINDOWS\FUCKDATA2000.LOG EliStarA.exe File opened for modification C:\WINDOWS\HCF618.TXT EliStarA.exe File opened for modification C:\WINDOWS\GC_407.CNF EliStarA.exe File opened for modification C:\WINDOWS\PWISYS.INI EliStarA.exe File opened for modification C:\WINDOWS\Tasks\Shell File Extensions.job EliStarA.exe File opened for modification C:\WINDOWS\LOGCPU.BAT EliStarA.exe File opened for modification C:\WINDOWS\Media\libcurl-4.dll EliStarA.exe File opened for modification C:\WINDOWS\Media\ssleay32.dll EliStarA.exe File opened for modification C:\WINDOWS\Media\zlib1.dll EliStarA.exe File opened for modification C:\WINDOWS\Tasks\iCloud Free Disk.job EliStarA.exe File opened for modification C:\WINDOWS\Tasks\NetvalTask.job EliStarA.exe -
description ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{265C2AF8-C94C-4AFF-B2B6-340D3982562C} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2D00AA2A-69EF-487a-8A40-B3E27F07C91E}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8BF1632C-8620-20BF-57F5-5A7C9F8AA290}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F7B841C2-39C5-4B60-93C3-1C7A31D21F30}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{7C559105-9ECF-42B8-B3F7-832E75EDD959} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{24E9519B-3F70-429B-99BC-4B2B49B96F66} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{224530A0-C9CB-4AEE-9C0F-54AC1B533211} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{69357D4E-BF4D-4651-91E9-52ECD45A0128}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{86554CF9-BECE-4F81-B497-AD33FAD3E203} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C84D8A0A-E708-42B6-90CA-9C30956A87C6}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{136F24A7-6C64-4EBE-B271-6B5C65DBB8E0}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{39E6E4A6-E6C3-48D7-8D25-7E964D8CD46F}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{9E6CD9DF-5EF9-40F4-84FA-C4842EB1F283} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{4AA7B12D-AB2C-4D16-BCFB-704945A98FDD} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{9DB30F1E-538B-4395-9E49-37C1429AB459}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{002F4E27-B273-4FA5-ADFC-1FB9ED210B37}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{060BB0AB-4B09-4C51-9ECB-9580A6D08D7F} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{100EB1FD-D03E-47FD-81F3-EE91287F9465} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{CAC89FF9-34A9-4431-8CFE-292A47F843BC} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{34E6F97C-34E0-4CE5-B92B-F83634BEDC01} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{A133882E-2F89-47A3-A01C-8FA1D04B8E57} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CDB280E8-BE43-4128-8A5A-3FCD094E2D88}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{6270DFC1-EDFB-4BC4-BE8C-842740BA290B} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{79806449-AB35-42EC-9BE9-B390209CE514}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{84FEBFF8-945B-4F9A-B9B8-B68EC5020770} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1A75F101-126E-46A3-97B1-91A96D161C15}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{1CB20BF0-BBAE-40A7-93F4-6435FF3D0411} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{336EC37F-54BF-4F13-8237-03F64FA591E7} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{58FB2CBB-C874-45FC-A1C9-B62CC9E3BED9} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BD344AF4-67AB-4E19-A630-7435587D320B} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{038FF0E2-C6A6-4782-B89E-586A3DDF16C7} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{C3703265-4671-4858-92A4-CBA6A7B3BB45} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{C5B70256-5B08-4056-B84E-C6CE084967F5} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CA13D72F-2DAC-4D99-B08D-C5EA1C920E89}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{020487CC-FC04-4B1E-863F-D9801796230B} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{56F1D444-11BF-4879-A12B-79CF0177F038} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{5D945E9A-DC10-4670-83EB-99DAA616628A}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{E8FA0CE0-BDAA-4E34-87F5-3B6D8217A0DA} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F38D448A-F274-4C34-B13B-A3E505E95209}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{4F9BDD4A-49A9-484F-A382-5F6FAC63E9FE} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{8071E65A-3F56-4426-8372-8667CD213057} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{2FED48A0-A7AF-4A95-AC3D-8C77F030ED9E}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{58F9B276-E1CC-458E-8159-21CBC021874B}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8BF5B8FC-11CB-409F-8C91-4D4CA04A1B6D}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BDF6CE3D-F5C5-4462-9814-3C8EAC330CA8} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E97A663B-81A6-49C5-A6D3-BCB05BA1DE26}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E0CE16CB-741C-4B24-8D04-A817856E07F4}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{08BBCF68-9AD5-4E1B-BC3D-29BF54B6EBFA}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{97A8B0F7-AD05-4AA4-B475-7EFA330F6AC1}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8E015787-B1E3-404A-95DE-3E71E1FA0305}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{9C0CFA58-3A6F-51BA-9EFE-5320F4F621BA} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{BA048011-957F-4BA0-A804-62C28D96F878} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{10F0C2A9-8E38-43e3-204D-45524C494E20} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{183643C8-EE67-4574-9A38-927852E34163}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{27150F81-0877-42E9-AF13-55E5A3439A26} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{4A474709-255B-5A0F-7626-C7ECF4273D71} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{57A70350-87D9-4EA2-B3AC-C1C1B5296035}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{90A22E29-FE54-447F-B5ED-6091733AB22F} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E9FE24FA-3113-4A03-908E-FF71D5AC683C}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{22AE4869-4E8A-457B-9F8F-CC340A5A450B}\Compatibility Flags = "1024" EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{3CA60057-9277-49C0-8D64-280DBAD9C3E1} EliStarA.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\ActiveX Compatibility\{096C4D28-3F5D-44A6-88F3-9842AD843D5C} EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C98D5B61-B0EA-4D48-9839-1079D352D880}\Compatibility Flags = "1024" EliStarA.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D869742A-E5D2-4624-96C7-AAE26170665E}\Compatibility Flags = "1024" EliStarA.exe -
Modifies registry class 53 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.js EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\jsfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "batfile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.com\ = "comfile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.bat EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\PersistentHandler EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\Content Type = "application/hta" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.reg\ = "regfile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\JSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbefile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.reg EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "\"%1\" /S" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.exe EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.com EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBSFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.htc EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.hta\ = "htafile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mscfile\shell\open\command\ = "%SystemRoot%\\system32\\mmc.exe \"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.cmd\ = "cmdfile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\about EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\MSCFile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htc\Content Type = "text/x-component" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "exefile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\VBEFile\Shell\Open\Command\ = "WScript.exe \"%1\" %*" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\cmdfile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hta EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "VBSFile" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.js\ = "JSFile" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\vbsfile\shell\open\command EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inffile\shell\open\command\ = "Notepad.exe \"%1\"" EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" EliStarA.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command EliStarA.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "Regedit.exe \"%1\"" EliStarA.exe -
Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe 548 EliStarA.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 548 EliStarA.exe Token: SeRestorePrivilege 548 EliStarA.exe Token: SeShutdownPrivilege 548 EliStarA.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 548 EliStarA.exe 548 EliStarA.exe -
Suspicious use of WriteProcessMemory 44 IoCs
description pid Process procid_target PID 548 wrote to memory of 1208 548 EliStarA.exe 81 PID 548 wrote to memory of 1208 548 EliStarA.exe 81 PID 548 wrote to memory of 1456 548 EliStarA.exe 82 PID 548 wrote to memory of 1456 548 EliStarA.exe 82 PID 548 wrote to memory of 672 548 EliStarA.exe 124 PID 548 wrote to memory of 672 548 EliStarA.exe 124 PID 548 wrote to memory of 4480 548 EliStarA.exe 123 PID 548 wrote to memory of 4480 548 EliStarA.exe 123 PID 548 wrote to memory of 5104 548 EliStarA.exe 83 PID 548 wrote to memory of 5104 548 EliStarA.exe 83 PID 548 wrote to memory of 1196 548 EliStarA.exe 121 PID 548 wrote to memory of 1196 548 EliStarA.exe 121 PID 548 wrote to memory of 1256 548 EliStarA.exe 120 PID 548 wrote to memory of 1256 548 EliStarA.exe 120 PID 548 wrote to memory of 1952 548 EliStarA.exe 119 PID 548 wrote to memory of 1952 548 EliStarA.exe 119 PID 548 wrote to memory of 3096 548 EliStarA.exe 118 PID 548 wrote to memory of 3096 548 EliStarA.exe 118 PID 548 wrote to memory of 4176 548 EliStarA.exe 117 PID 548 wrote to memory of 4176 548 EliStarA.exe 117 PID 548 wrote to memory of 3540 548 EliStarA.exe 115 PID 548 wrote to memory of 3540 548 EliStarA.exe 115 PID 548 wrote to memory of 1904 548 EliStarA.exe 114 PID 548 wrote to memory of 1904 548 EliStarA.exe 114 PID 548 wrote to memory of 4736 548 EliStarA.exe 113 PID 548 wrote to memory of 4736 548 EliStarA.exe 113 PID 548 wrote to memory of 3556 548 EliStarA.exe 112 PID 548 wrote to memory of 3556 548 EliStarA.exe 112 PID 548 wrote to memory of 1784 548 EliStarA.exe 111 PID 548 wrote to memory of 1784 548 EliStarA.exe 111 PID 548 wrote to memory of 4128 548 EliStarA.exe 109 PID 548 wrote to memory of 4128 548 EliStarA.exe 109 PID 548 wrote to memory of 3508 548 EliStarA.exe 108 PID 548 wrote to memory of 3508 548 EliStarA.exe 108 PID 548 wrote to memory of 3500 548 EliStarA.exe 85 PID 548 wrote to memory of 3500 548 EliStarA.exe 85 PID 548 wrote to memory of 2268 548 EliStarA.exe 107 PID 548 wrote to memory of 2268 548 EliStarA.exe 107 PID 548 wrote to memory of 5064 548 EliStarA.exe 106 PID 548 wrote to memory of 5064 548 EliStarA.exe 106 PID 548 wrote to memory of 2988 548 EliStarA.exe 105 PID 548 wrote to memory of 2988 548 EliStarA.exe 105 PID 548 wrote to memory of 3864 548 EliStarA.exe 87 PID 548 wrote to memory of 3864 548 EliStarA.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"C:\Users\Admin\AppData\Local\Temp\EliStarA.exe"1⤵
- Modifies system executable filetype association
- Adds policy Run key to start application
- Drops file in Drivers directory
- Sets service image path in registry
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}\*.*" /a /q"2⤵PID:1208
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com2.{62D8ED13-C9D0-4CE8-A914-47DD628FB1B0}""2⤵PID:1456
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}\*.*" /a /q"2⤵PID:5104
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.sys"2⤵PID:3500
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.usb"2⤵PID:3864
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.usb\*.* /a /q"2⤵PID:2988
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd \\.\C:\con.ini"2⤵PID:5064
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.ini\*.* /a /q"2⤵PID:2268
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del \\.\C:\con.sys\*.* /a /q"2⤵PID:3508
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}""2⤵PID:4128
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\WINDOWS\FONTS\COM4.{241D7C96-F8BF-4F85-B01F-E2B043341A4B}\*.*" /a /q"2⤵PID:1784
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:3556
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt7.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:4736
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}""2⤵PID:1904
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt6.{17cd9488-1228-4b2f-88ce-4298e93e0966}\*.*" /a /q"2⤵PID:3540
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}""2⤵PID:4176
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt3.{1D2680C9-0E2A-469d-B787-065558BC7D43}\*.*" /a /q"2⤵PID:3096
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}""2⤵PID:1952
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\lpt2.{20D04FE0-3AEA-1069-A2D8-08002B30309D}\*.*" /a /q"2⤵PID:1256
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com6.{00C6D95F-329C-409a-81D7-C46C66EA7F33}""2⤵PID:1196
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "rd "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}""2⤵PID:4480
-
-
C:\Windows\SYSTEM32\cmd.execmd /c "del "\\.\C:\Users\Admin\AppData\Roaming\com4.{05d7b0f4-2121-4eff-bf6b-ed3f69b894d9}\*.*" /a /q"2⤵PID:672
-