054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa

Analysis

max time kernel
112s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
14/03/2023, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Size

404KB
MD5

31a46564145f167c90cde7221904df31
SHA1

d9021f000b203d37a13ca3b6eae037b7c2817b9e
SHA256

054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa
SHA512

1bb4a784a41ce3cb3be59e3fba6b68617a396c542d870c750117573d4774b581dc72b821a4976e2199582cac455b10ff930561fae304545acc9f8879439da400
SSDEEP

6144:rwTOAkRjUmqjDtFQHo7l37jaxIZm8ezKMH0Q4exxrp7Myuuh/Wr0LRU:0TOAkRj7IqoRHaxYmzzxrFdLh/20tU

Score

10^/10

adware discovery evasion stealer

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 4 IoCs

evasion

Modify Registry

T1112

Modify Existing Service

T1031

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe:*:enabled:@shell32.dll,-1"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Loads dropped DLL 2 IoCs

pid	Process
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}\ = "Ask Toolbar BHO"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
File created	C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
File opened for modification	C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
File created	C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Toolbar\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\Instance\CLSID = "{4D5C8C2A-D075-11d0-B416-00C04FB90376}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\ = "Ask Toolbar Settings"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE063DB0-4EC0-403E-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{FE063DB0-4EC0-403E-8DD8-394C54984B2C}\1.0	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\ = "IAskTBarSettings"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\InprocServer32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\ = "_IAskTBarPopSwatterSettingsEvents"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton\CurVer\ = "AskTBar.PopSwatterBarButton.1"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\ProgID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\ = "Ask PopSwatter"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.SettingsPlugin.1	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\ProgID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\TypeLib\Version = "1.0"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton.1\ = "Bar Button Class"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton.1\CLSID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9AFB8248-617F-460d-9366-D71CDEDA3179}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\Version = "1.0"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.SettingsPlugin.1\CLSID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\Control	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton.1\CLSID\ = "{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl\ = "PopSwatter Settings Class"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\ = "PopSwatter Settings Class"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0\0\win32\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\A5POPSWT.DLL"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\Version	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\Version\ = "1.0"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\Implemented Categories\{00021493-0000-0000-C000-000000000046}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}\Programmable	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\ = "{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB1-4EC0-403e-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl.1\CLSID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\ProxyStubClsid32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DBB-4EC0-403e-8DD8-394C54984B2C}\TypeLib	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\TypeLib\ = "{FE063DB0-4EC0-403E-8DD8-394C54984B2C}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ProxyStubClsid32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\TypeLib\ = "{FE063DB0-4EC0-403E-8DD8-394C54984B2C}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\ProgID\ = "AskTBar.PopSwatterBarButton.1"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}\InprocServer32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72FE8681-0BFA-471b-9B2A-B37ED68DD09E}\Instance	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{147A976F-EEE1-4377-8EA7-4716E4CDD239}\	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{09BD51AE-7E02-4916-9B12-647A92C02B7F}\InprocServer32\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\A5POPSWT.DLL"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FE063DB9-4EC0-403e-8DD8-394C54984B2C}	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{FE063DBC-4EC0-403E-8DD8-394C54984B2C}\ = "_IAskTBarSettingsEvents"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterBarButton\CurVer	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\Programmable	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl.1	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\VersionIndependentProgID	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{83453071-3F9C-4ab0-BE30-EDA368D7976D}\Programmable	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib\ = "{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{83453072-3F9C-4AB0-BE30-EDA368D7976D}\ProxyStubClsid32	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\InprocServer32\ = "C:\\Program Files (x86)\\AskTBar\\bar\\1.bin\\A5POPSWT.DLL"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AskTBar.PopSwatterSettingsControl.1\ = "PopSwatter Settings Class"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{BD04DAE0-8C1B-4CC5-9E06-22DE05C2EDA0}\1.0\0	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83453070-3F9C-4AB0-BE30-EDA368D7976D}\TypeLib	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FE063DBA-4EC0-403E-8DD8-394C54984B2C}\TypeLib\ = "{FE063DB0-4EC0-403E-8DD8-394C54984B2C}"	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BD04DAE2-8C1B-4cc5-9E06-22DE05C2EDA0}\TypeLib	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Suspicious behavior: MapViewOfSection 64 IoCs

pid	Process
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 612	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	4
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 664	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	3
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 780	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	8
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 788	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	9
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 796	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	20
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 908	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	19
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 952	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	18
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 60	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	10
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 516	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	17
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 752	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	11
PID 4636 wrote to memory of 924	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	12
PID 4636 wrote to memory of 924	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	12
PID 4636 wrote to memory of 924	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	12
PID 4636 wrote to memory of 924	4636	054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe	12

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:60
- C:\Windows\system32\fontdrvhost.exe
  "fontdrvhost.exe"
  2⤵
  PID:796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p
1⤵
PID:780
- C:\Windows\system32\wbem\unsecapp.exe
  C:\Windows\system32\wbem\unsecapp.exe -Embedding
  2⤵
  PID:3048
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3476
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3696
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
  2⤵
  PID:2652
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
  2⤵
  PID:1472
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:1772
- C:\Windows\system32\backgroundTaskHost.exe
  "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca
  2⤵
  PID:3264
- C:\Windows\system32\SppExtComObj.exe
  C:\Windows\system32\SppExtComObj.exe -Embedding
  2⤵
  PID:2252
- C:\Windows\system32\wbem\wmiprvse.exe
  C:\Windows\system32\wbem\wmiprvse.exe
  2⤵
  PID:2200
- C:\Windows\system32\DllHost.exe
  C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
  2⤵
  PID:3536
- C:\Windows\System32\RuntimeBroker.exe
  C:\Windows\System32\RuntimeBroker.exe -Embedding
  2⤵
  PID:3928
- C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
  2⤵
  PID:3768
- C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
  "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
  2⤵
  PID:3632

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:788

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
PID:1092
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1184

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork -p
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1012

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:952

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k RPCSS -p
1⤵
PID:908

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
PID:1224

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1336

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1380

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1388
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2384

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1564

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3240

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3132
- C:\Users\Admin\AppData\Local\Temp\054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe
  "C:\Users\Admin\AppData\Local\Temp\054eeaa9f120f3613cf06ad010c58adf025c4f8c03dcc6da6acd567be27e87aa.exe"
  2⤵
  - Modifies firewall policy service
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4636

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
PID:2612

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2604

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2584

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
PID:2572

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
PID:2504

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
PID:2496

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s W32Time
1⤵
PID:4064

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:1628

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:3720

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
PID:2144

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
PID:1572

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:4172

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4408

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2416

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2332

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2164

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetworkFirewall -p
1⤵
PID:1704

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:1452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1920

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1852

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1828

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1732

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1712

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1592

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1556

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\AskTBar\bar\1.bin\A5POPSWT.DLL

Filesize
116KB

MD5
69a3eb924678bb23047e6248648e6534

SHA1
844949940edfa51d38c5fa3294892b92c8d3cf8e

SHA256
8150669b6e743bdc725abfd4e51c3da721e4b1a2a86ee2cda4d61f8e2bbee851

SHA512
6f3c3b4a81965a6cf462943f1c0b0c8db1fbe7b89e24459411dc279cb18d534568c2cf0097bfea6848ceca9818bf10f86c1ea4aaf601f1b1e42dbd9ec696dd06

Download Submit
C:\Program Files (x86)\AskTBar\bar\1.bin\ASKTBAR.DLL

Filesize
240KB

MD5
59dbfe16aa20144cb11e7fc8b2d21eaa

SHA1
b4403810c1db8482c5a26b418499a8643e4a6410

SHA256
809bbfa3fb67c79f1901b159b754dd955c5defe28d5879f91972d269d706d55c

SHA512
83ce6c1631d36ebc19be3fc178932f41fdef7c7f8a9dd5d3631527a25f894936477a053ad96d65ba58b8775732741b52af1edc390b260009775406b05df36297

Download Submit
memory/4636-133-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4636-134-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4636-140-0x0000000000400000-0x0000000000466000-memory.dmp

Filesize
408KB

Download
memory/4636-143-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4636-146-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download
memory/4636-148-0x000000007FE40000-0x000000007FE4C000-memory.dmp

Filesize
48KB

Download