0ad87a1b2a2d6798f5cbb0601920136237ba9d03720f96290130b3f1db0e43eb

Modify Registry

Processes:

instup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswElam\ImagePath = "system32\\drivers\\aswElam.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys"	instup.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3346939869-2835594282-3775165920-1000\Control Panel\International\Geo\Nation	kaspersky4win202121.9.6.465es_37946 (1).exe

Executes dropped EXE 31 IoCs

Processes:

avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeavBugReport.exeRegSvr.exeRegSvr.exeRegSvr.exeRegSvr.exeAvastNM.exeSetupInf.exeoverseer.exeengsup.exewsc_proxy.exewsc_proxy.exeengsup.exe

pid	process
4036	avast_free_antivirus_setup_online.exe
4572	avast_free_antivirus_setup_online_x64.exe
504	instup.exe
3416	instup.exe
3192	aswOfferTool.exe
1820	aswOfferTool.exe
4428	aswOfferTool.exe
3320	aswOfferTool.exe
3764	aswOfferTool.exe
1424	aswOfferTool.exe
2624	aswOfferTool.exe
1060	sbr.exe
6072	SetupInf.exe
3696	SetupInf.exe
792	SetupInf.exe
300	SetupInf.exe
3440	SetupInf.exe
4724	AvEmUpdate.exe
5008	AvEmUpdate.exe
5836	avBugReport.exe
6060	RegSvr.exe
1536	RegSvr.exe
4216	RegSvr.exe
4296	RegSvr.exe
4868	AvastNM.exe
5044	SetupInf.exe
1820	overseer.exe
1696	engsup.exe
5200	wsc_proxy.exe
5260	wsc_proxy.exe
5352	engsup.exe

Loads dropped DLL 41 IoCs

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exeavast_free_antivirus_setup_online.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exe

pid	process
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4036	avast_free_antivirus_setup_online.exe
504	instup.exe
504	instup.exe
504	instup.exe
504	instup.exe
3416	instup.exe
4428	aswOfferTool.exe
3764	aswOfferTool.exe
1424	aswOfferTool.exe
2624	aswOfferTool.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

RegSvr.exeRegSvr.exeinstup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ThreadingModel = "Apartment"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\asOutExt.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

Processes:

instup.exewsc_proxy.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	wsc_proxy.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

instup.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1063

Processes:

avBugReport.exeengsup.exewsc_proxy.exeSetupInf.exeinstup.exeRegSvr.exeSetupInf.exeSetupInf.exewsc_proxy.exeAvEmUpdate.exeRegSvr.exeSetupInf.exeAvastNM.exeengsup.exeAvEmUpdate.exeRegSvr.exeinstup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\NoPPL	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	engsup.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	avBugReport.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{19EA8BF0-A12F-1AF0-FB25-293AD7155932}\ScanTypes = "AllFiles"	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{19EA8BF0-A12F-1AF0-FB25-293AD7155932}	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{D93EF81A-B92F-27FE-AF54-9278EA8BF910}	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	wsc_proxy.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP\Setting	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{EC4ECEDA-3E3B-4027-ABFE-29A5122D64D6}\Priority = "1"	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{7C4966F0-D502-412D-A636-ACCC39A24BB2}	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	wsc_proxy.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	engsup.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	avBugReport.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{D93EF81A-B92F-27FE-AF54-9278EA8BF910}\DefaultTask = "1"	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	SetupInf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{EC4ECEDA-3E3B-4027-ABFE-29A5122D64D6}\ScanType = "Extensions"	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	avBugReport.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\WOW6432Node\Avira\Antivirus	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SafeZoneBrowserDebug	AvastNM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner\Task1 = "{EC4ECEDA-3E3B-4027-ABFE-29A5122D64D6}"	wsc_proxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{CB6AE6F8-D9A8-4794-B2BF-53A84058C58F}\TaskImage = "screensaver"	wsc_proxy.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{FDC844BC-62CE-4A58-A28B-77AA70274062}\Job = "Scan"	wsc_proxy.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Patches	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	AvastNM.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	AvEmUpdate.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MicroUpdates = 3300310037003d00310036003800300038003100350030003100390000003400330039003d00310036003800300038003100350030003100390000000000	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\ShowWelcomePage	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder	avBugReport.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\CrashGuard	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{93876F24-B4F5-4DBC-97B9-762CD8066719}	wsc_proxy.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry = "1"	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	AvEmUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\{D93EF81A-B92F-27FE-AF54-9278EA8BF910}\TaskSensitivity = "40"	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\SoftTrialActivated	avBugReport.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	kaspersky4win202121.9.6.465es_37946 (1).exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 20 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exeavast_free_antivirus_setup_online.exeinstup.exeSetupInf.exeSetupInf.exeRegSvr.exeSetupInf.exeSetupInf.exeoverseer.exewsc_proxy.exeavast_free_antivirus_setup_online_x64.exeinstup.exeSetupInf.exeRegSvr.exeSetupInf.exeAvEmUpdate.exeavBugReport.exeRegSvr.exeRegSvr.exewsc_proxy.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	kaspersky4win202121.9.6.465es_37946 (1).exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	avBugReport.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe

Drops file in System32 directory 3 IoCs

Processes:

instup.exeSetupInf.exe

description	ioc	process
File opened for modification	C:\Windows\system32\aswc7f457af8e2439f9.tmp	instup.exe
File created	C:\Windows\system32\aswc7f457af8e2439f9.tmp	instup.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe

Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

kaspersky4win202121.9.6.465es_37946 (1).exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN kaspersky4win202121.9.6.465es_37946 (1).exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	kaspersky4win202121.9.6.465es_37946 (1).exe

Drops file in Program Files directory 64 IoCs

Processes:

instup.exeAvEmUpdate.exeengsup.exeAvastNM.exe

description	ioc	process
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw8a5a26c395744711.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswIdle.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-string-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\aswhookx.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\ashShell.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\nos.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswSnx.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\db_dex.sig	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-time-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x64	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\CRT	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\asw024cf1038ee19abb.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\Inf\x64\asw6a157d69c0607893.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\aswArray.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswImgPr.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Setup\2cae932a-c4ba-4047-90ca-cf952f6e7dea\update.xml	AvEmUpdate.exe
File created	C:\Program Files\Avast Software\Avast\defs\23040599\avast.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll	engsup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\asw6c09629d232834d1.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw698256fe7b156c8c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\aswCleanerDLL.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\ais_cmp_idp_x64-8e5.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw71fd67689e76f993.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw0f37a099fc16cafd.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.vc140.crt	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\vcruntime140_1.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\aswBoot.exe	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw61dad282a6b8b5d8.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswe2e8534d4da49a3e.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw9525019404507e19.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\wsc_proxy.exe.manifest.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswMonFlt.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\asw3136ed2e9ca6c86c.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw14f759d5be80ced0.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\aswInfTg.htm	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x86\aswbidshx.sys	instup.exe
File created	C:\Program Files\Avast Software\Avast\Setup\fedb5e1c-94a0-4ecc-a835-0dacc7cb0f30\update.xml	AvEmUpdate.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\aswbeaf42faeccee495.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\23040599\db_ap2.dat	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRvrt.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw2dfedce99beefc0a.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\event_manager_ga.dll	instup.exe
File created	C:\Program Files\Avast Software\Avast\AvastNM.json	AvastNM.exe
File created	C:\Program Files\Avast Software\Avast\asw85b1cea5792e4fef.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\asw66ac1cd1329a230d.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRdr2.sys.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswElam.sys.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-process-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\ais_gen_core_x64-89a.vpx	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw48ac19348ab96a3d.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\23040599\aswf4fbd4ea8817d09b.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asw48ac19348ab96a3d.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswAMSI.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswSZB.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\aswRdr2.cat	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\aswe659b86d586a3a14.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\ais_gen_openssl_x64-7e4.vpx	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\prod-vps.vpx	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\asw70707f4d9f6a4e90.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\asw4d9262f3022289bc.tmp	instup.exe

Drops file in Windows directory 2 IoCs

Processes:

instup.exe

description	ioc	process
File opened for modification	C:\Windows\ELAMBKUP\asw85d6f9520e48c52b.tmp	instup.exe
File created	C:\Windows\ELAMBKUP\asw85d6f9520e48c52b.tmp	instup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

instup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	instup.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

SetupInf.exeAvEmUpdate.exeAvEmUpdate.exewsc_proxy.exeinstup.exeSetupInf.exeSetupInf.exeSetupInf.exeavBugReport.exeRegSvr.exeSetupInf.exeRegSvr.exeRegSvr.exeSetupInf.exeengsup.exeavast_free_antivirus_setup_online_x64.exeRegSvr.exeinstup.exewsc_proxy.exeengsup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	avBugReport.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	instup.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exeinstup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

Processes:

RegSvr.exeRegSvr.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133252882559848957"	chrome.exe

Modifies registry class 64 IoCs

Processes:

instup.exeRegSvr.exeRegSvr.exeinstup.exeRegSvr.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswntsqlitex.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastthemefile\shell\open\command	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avast.AsOutExt\CurVer\ = "Avast.AsOutExt.1"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "25"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_dll_eng"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswJsFlt.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_bank.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswEngSrv.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\ashShA64.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastsoundsfile\shell	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "81"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswsecapi.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\avast.vc140.mfc"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F64B349A-BD50-415F-9F99-72E00C161493}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "33"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ArPot.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: protobuf.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\AhResIdp.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\vps_win32-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\ProgID	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\Version	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: avdump_x86_ais"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: zlib.txt"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastvpnfile\shell\open\command	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "37"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswShMin.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mbedTLS.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\gaming_probe.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "92"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_mx4.sig"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastsoundsfile\shell\open\command	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\ProgID	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "96"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_core"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Creating directory: C:\\ProgramData\\Avast Software\\Avast\\journal"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\avast.vc140.debugmfc"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "51"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "61"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: list_i.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: BrowserCleanup.ini"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: module_lifetime.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Installing kernel driver: aswRdr"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Starting kernel driver: aswNetHub"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: exts.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "76"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswDataScan.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Updating package: offertool_x64_ais"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "10"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "19"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: config.def"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: msvcp140_codecvt_ids.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\vps_bootwin32-*.vpx"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastsoundsfile	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "72"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "89"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ucrtbase.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\License"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\part-vps_win32-*.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\ais_gui_res_omni-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "21"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_cf.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Avast Software\\Avast\\log\\*.log.7"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Copying file: C:\\Program Files\\Avast Software\\Avast\\setup\\settings-17aa.ori to C:\\Program Files\\Avast Software\\Avast\\setup\\settings.ori"	instup.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

chrome.exekaspersky4win202121.9.6.465es_37946 (1).exechrome.exeavast_free_antivirus_setup_online_x64.exeinstup.exe

pid	process
3728	chrome.exe
3728	chrome.exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
4312	kaspersky4win202121.9.6.465es_37946 (1).exe
3728	chrome.exe
3728	chrome.exe
2056	chrome.exe
2056	chrome.exe
4572	avast_free_antivirus_setup_online_x64.exe
4572	avast_free_antivirus_setup_online_x64.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe

Suspicious behavior: LoadsDriver 13 IoCs

Processes:

pid process

596
596
596
596
596
596
596
596
596
596
596
596
596

pid	process
596
596
596
596
596
596
596
596
596
596
596
596
596

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 25 IoCs

Processes:

chrome.exe

pid	process
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe
Token: SeShutdownPrivilege	3728	chrome.exe
Token: SeCreatePagefilePrivilege	3728	chrome.exe

Suspicious use of FindShellTrayWindow 55 IoCs

Processes:

chrome.exeinstup.exe

pid	process
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3416	instup.exe
3416	instup.exe
3416	instup.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe

Suspicious use of SendNotifyMessage 34 IoCs

Processes:

chrome.exeinstup.exe

pid	process
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3416	instup.exe
3416	instup.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe
3728	chrome.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

instup.exeinstup.exe

pid process

504 instup.exe
3416 instup.exe
3416 instup.exe

pid	process
504	instup.exe
3416	instup.exe
3416	instup.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 3728 wrote to memory of 4132	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4132	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 4448	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 1084	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 1084	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe
PID 3728 wrote to memory of 2716	3728	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xac,0xd8,0x7ffc51979758,0x7ffc51979768,0x7ffc51979778
2⤵
PID:4132

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:2
2⤵
PID:4448

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:1084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1720 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:2716

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3640

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3524

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:1880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4568 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:3252

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:3696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5416 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4788

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:696

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5368 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3952

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2988 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:2856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3088 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4024

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=2964 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3212

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=3228 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4928

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=4784 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:936

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=4888 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:2860

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5624 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3396

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4380 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:3376

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5468 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:2108

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2512 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:500

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=5816 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:2504

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5224 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=26 --mojo-platform-channel-handle=2680 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3796

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=5616 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5548 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5468 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4364

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=5924 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4756

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=31 --mojo-platform-channel-handle=4792 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:1128

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=5472 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:588

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=2452 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4048

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2680 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4208

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=5700 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3684

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=1588 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4004

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5768 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:2624

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5144 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:1124

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5208 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4020

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6160 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:2044

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6416 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:4032

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=4988 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:2056

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=43 --mojo-platform-channel-handle=6488 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:2964

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6292 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:3924

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6072 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:3372

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6220 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:2612

C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe
"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
PID:4036

C:\Windows\Temp\asw.491174b3c02205a3\avast_free_antivirus_setup_online_x64.exe
"C:\Windows\Temp\asw.491174b3c02205a3\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_012_999_a7d_m /ga_clientid:f52ae8f2-da57-46ec-95d6-753fd8302cfc /edat_dir:C:\Windows\Temp\asw.491174b3c02205a3
3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
PID:4572

C:\Windows\Temp\asw.9782931ac618d6bf\instup.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.9782931ac618d6bf /edition:1 /prod:ais /guid:022c387b-3448-48ec-974f-b34554ae5940 /ga_clientid:f52ae8f2-da57-46ec-95d6-753fd8302cfc /cookie:mmm_ava_012_999_a7d_m /ga_clientid:f52ae8f2-da57-46ec-95d6-753fd8302cfc /edat_dir:C:\Windows\Temp\asw.491174b3c02205a3
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:504

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\instup.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.9782931ac618d6bf /edition:1 /prod:ais /guid:022c387b-3448-48ec-974f-b34554ae5940 /ga_clientid:f52ae8f2-da57-46ec-95d6-753fd8302cfc /cookie:mmm_ava_012_999_a7d_m /edat_dir:C:\Windows\Temp\asw.491174b3c02205a3 /online_installer
5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3416

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" -checkGToolbar -elevated
6⤵
- Executes dropped EXE
PID:3192

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" /check_secure_browser
6⤵
- Executes dropped EXE
PID:1820

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4428

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC
6⤵
- Executes dropped EXE
PID:3320

C:\Users\Public\Documents\aswOfferTool.exe
"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC
7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3764

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\aswOfferTool.exe" -checkChrome -elevated
6⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2624

C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\sbr.exe
"C:\Windows\Temp\asw.9782931ac618d6bf\New_170317aa\sbr.exe" 3416 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
6⤵
- Executes dropped EXE
PID:1060

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:6072

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:3696

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:792

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:300

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:3440

C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4724

C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer1
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
PID:5008

C:\Program Files\Avast Software\Avast\avBugReport.exe
"C:\Program Files\Avast Software\Avast\avBugReport.exe" --send "dumps|report" --silent --path "C:\ProgramData\Avast Software\Avast" --logpath "C:\ProgramData\Avast Software\Avast\log" --guid 022c387b-3448-48ec-974f-b34554ae5940
7⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:5836

C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
PID:6060

C:\Program Files\Avast Software\Avast\RegSvr.exe
"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
PID:1536

C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\asOutExt.dll"
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:4216

C:\Program Files\Avast Software\Avast\RegSvr.exe
"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\asOutExt.dll"
6⤵
- Executes dropped EXE
- Registers COM server for autorun
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
PID:4296

C:\Program Files\Avast Software\Avast\AvastNM.exe
"C:\Program Files\Avast Software\Avast\AvastNM.exe" /install
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
PID:4868

C:\Program Files\Avast Software\Avast\SetupInf.exe
"C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:FA726DE39EFE3E15CEE91CD7BCFA28756CD72153
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
PID:5044

C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations
6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
PID:1820

C:\Program Files\Avast Software\Avast\defs\23040599\engsup.exe
"C:\Program Files\Avast Software\Avast\defs\23040599\engsup.exe" /prepare_definitions_folder
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Drops file in Program Files directory
- Checks processor information in registry
PID:1696

C:\Program Files\Avast Software\Avast\wsc_proxy.exe
"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc
6⤵
- Executes dropped EXE
- Windows security modification
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:5200

C:\Program Files\Avast Software\Avast\defs\23040599\engsup.exe
"C:\Program Files\Avast Software\Avast\defs\23040599\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:5352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:4856

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=48 --mojo-platform-channel-handle=5428 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:1
2⤵
PID:3356

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5404 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5436

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5388 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5444

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5352

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2412 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5476

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=3644 --field-trial-handle=1772,i,4339482340233467332,16316180743324301562,131072 /prefetch:8
2⤵
PID:5560

C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe
"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
PID:4312

C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe
"C:\Users\Admin\AppData\Local\Temp\kaspersky4win202121.9.6.465es_37946 (1).exe" -cleanup="C:\Users\Admin\AppData\Local\Temp\1180FB4ADB4DDE116B372E6B1421A7C3;4312"
2⤵
PID:4700

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5060

C:\Program Files\Avast Software\Avast\wsc_proxy.exe
"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /runassvc /rpcserver
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:5260

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localservice -s fdPHost
1⤵
PID:4036

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

Security Software Discovery

T1063

System Information Discovery