3bc1e207766bcff7b7328c5d336ec8e9211485cfd05242a0ff79e1a8ef49b1fb

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Control Panel\International\Geo\Nation	gsam.exe

Executes dropped EXE 3 IoCs

pid	Process
2424	setup-gridinsoft-fix.exe
2500	f69pTkh2.4pY
2220	gsam.exe

Loads dropped DLL 16 IoCs

pid	Process
2424	setup-gridinsoft-fix.exe
2500	f69pTkh2.4pY
2500	f69pTkh2.4pY
2500	f69pTkh2.4pY
1628	regsvr32.exe
1972	regsvr32.exe
2424	setup-gridinsoft-fix.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
1324	Process not Found
1324	Process not Found
1324	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ = "C:\\PROGRA~1\\GRIDIN~1\\shellext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\v:	gsam.exe
File opened (read-only)	\??\w:	gsam.exe
File opened (read-only)	\??\f:	gsam.exe
File opened (read-only)	\??\g:	gsam.exe
File opened (read-only)	\??\p:	gsam.exe
File opened (read-only)	\??\r:	gsam.exe
File opened (read-only)	\??\k:	gsam.exe
File opened (read-only)	\??\l:	gsam.exe
File opened (read-only)	\??\o:	gsam.exe
File opened (read-only)	\??\u:	gsam.exe
File opened (read-only)	\??\a:	gsam.exe
File opened (read-only)	\??\b:	gsam.exe
File opened (read-only)	\??\e:	gsam.exe
File opened (read-only)	\??\i:	gsam.exe
File opened (read-only)	\??\x:	gsam.exe
File opened (read-only)	\??\h:	gsam.exe
File opened (read-only)	\??\j:	gsam.exe
File opened (read-only)	\??\q:	gsam.exe
File opened (read-only)	\??\z:	gsam.exe
File opened (read-only)	\??\y:	gsam.exe
File opened (read-only)	\??\m:	gsam.exe
File opened (read-only)	\??\n:	gsam.exe
File opened (read-only)	\??\s:	gsam.exe
File opened (read-only)	\??\t:	gsam.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1067

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	MEMZ.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\freebl3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\brazilian portuguese.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\spanish.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\turkish.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\sciter.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\mozcrt19.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\libeay32.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\sqlite3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\thai.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\gsam.exe	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\7z.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\russian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsinetsecurity.cat	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\pFilters.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\czech.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\gtkmgmtc.exe	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\german.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\tkcon.exe	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nss3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\hungarian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nspr4.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\dutch.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\bulgarian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\croatian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\libmem.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssckbi.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\danish.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\greek.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\italian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\persian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\swedish.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsdriver.cat	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\gsInetSecurity.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\ssleay32.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssutil3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\ukrainian.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.sys	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\offreg.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\plds4.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\english.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\polish.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\shellext.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\whatsnew.dat	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\french.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\japanese.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplds4.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssdbm3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\arabic.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\azerbaijani.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (Simplified).lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (traditional).lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\gtkmgmt.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\certutil.exe	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver64.sys	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\korean.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\sqlite3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libnspr4.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplc4.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\portuguese.lng	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\uninst.exe	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\smime3.dll	f69pTkh2.4pY
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\softokn3.dll	f69pTkh2.4pY

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	RUNDLL32.EXE
File opened for modification	C:\Windows\INF\setupapi.app.log	RUNDLL32.EXE
File opened for modification	C:\Windows\INF\setupapi.app.log	RUNDLL32.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gsam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	setup-gridinsoft-fix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup-gridinsoft-fix.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gsam.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = 68e38592d081d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 42 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms\AskUser = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 7095067bd081d901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f000000000200000000001066000000010000200000009a4beb71ab8701a895ffe2cc564297b44c3f9eab9482d46383e666bb942e2da0000000000e8000000002000020000000a752d42edca67bb77e3591947130e84afdc7dcc9165ca51d772504b329b09d4a90000000c6b89d678cb2bbc7be26eefc2eaee9f0917d1d1a123e4596f79e2a7060595910aeab927ba606b12aafa41aff62af5314a21e26e5155f146533e7c3c08b450866c5fe1c093c50a8e69b8dd638fc295df8aa6f802e6443d8f8b4869d945ae914721fc966cffa9e663eb69699fd0ec78a96a97a32e9db454a7a826f08effbcc696564a0f52dc6a205bf2a20888daa5000cd40000000d68acd4a45023572e392409317e9320bd56da4ddfae524ffa313cf6c150cd7a9d914e14d3e46ebb6550038e9368d0e3c95319e2b6503cd088812bc4e901584a5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "390330978"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A2D48DF1-EDC3-11ED-85DA-7E8ED113D2E8} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000000743fd071976334797e6012501984d1f000000000200000000001066000000010000200000003d8c12f376869562bcbb12243b1c6877312d124c4745d50a05991bb3da405326000000000e8000000002000020000000f12c79cbfd389d2e17e3d155becf49e1d629a1009c897931ceb518e8bfe7471420000000944f037fccb3b0d9a073e98317de9f0d356f124e65d72eae09683feaf7cfe13b40000000292660544454d03c1b39940f23bad0fea2d37b8f169e8a31db6d970d8b4ab99a17a7691b2713700eee0c99aaeba98ac5029ffbaf902da5418b63c4b61b6c6859	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2961826002-3968192592-354541192-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe

Modifies registry class 19 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ = "C:\\PROGRA~1\\GRIDIN~1\\shellext.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID\ = "shellext.Gridinsoft Anti-Malware"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2916	MEMZ.exe
2904	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe
2916	MEMZ.exe
2904	MEMZ.exe
2952	MEMZ.exe
2944	MEMZ.exe
2960	MEMZ.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
940	iexplore.exe
672	IEXPLORE.EXE
2484	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 30 IoCs

description	pid	Process
Token: 33	2784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2784	AUDIODG.EXE
Token: 33	2784	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2784	AUDIODG.EXE
Token: SeDebugPrivilege	2484	taskmgr.exe
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2284	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2456	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeRestorePrivilege	2548	RUNDLL32.EXE
Token: SeDebugPrivilege	2220	gsam.exe
Token: SeDebugPrivilege	2220	gsam.exe
Token: SeBackupPrivilege	2220	gsam.exe
Token: SeRestorePrivilege	2220	gsam.exe

Suspicious use of FindShellTrayWindow 48 IoCs

pid	Process
940	iexplore.exe
940	iexplore.exe
940	iexplore.exe
2424	setup-gridinsoft-fix.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2424	setup-gridinsoft-fix.exe
2220	gsam.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe
2484	taskmgr.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
940	iexplore.exe
940	iexplore.exe
672	IEXPLORE.EXE
672	IEXPLORE.EXE
672	IEXPLORE.EXE
672	IEXPLORE.EXE
940	iexplore.exe
940	iexplore.exe
2444	IEXPLORE.EXE
2444	IEXPLORE.EXE
940	iexplore.exe
672	IEXPLORE.EXE
672	IEXPLORE.EXE
2976	MEMZ.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe
2220	gsam.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 940	1724	launcherfull-shiginima-v4400.exe	28
PID 1724 wrote to memory of 940	1724	launcherfull-shiginima-v4400.exe	28
PID 1724 wrote to memory of 940	1724	launcherfull-shiginima-v4400.exe	28
PID 1724 wrote to memory of 940	1724	launcherfull-shiginima-v4400.exe	28
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 940 wrote to memory of 672	940	iexplore.exe	30
PID 2848 wrote to memory of 2916	2848	MEMZ.exe	36
PID 2848 wrote to memory of 2916	2848	MEMZ.exe	36
PID 2848 wrote to memory of 2916	2848	MEMZ.exe	36
PID 2848 wrote to memory of 2916	2848	MEMZ.exe	36
PID 2848 wrote to memory of 2904	2848	MEMZ.exe	37
PID 2848 wrote to memory of 2904	2848	MEMZ.exe	37
PID 2848 wrote to memory of 2904	2848	MEMZ.exe	37
PID 2848 wrote to memory of 2904	2848	MEMZ.exe	37
PID 2848 wrote to memory of 2944	2848	MEMZ.exe	38
PID 2848 wrote to memory of 2944	2848	MEMZ.exe	38
PID 2848 wrote to memory of 2944	2848	MEMZ.exe	38
PID 2848 wrote to memory of 2944	2848	MEMZ.exe	38
PID 2848 wrote to memory of 2960	2848	MEMZ.exe	39
PID 2848 wrote to memory of 2960	2848	MEMZ.exe	39
PID 2848 wrote to memory of 2960	2848	MEMZ.exe	39
PID 2848 wrote to memory of 2960	2848	MEMZ.exe	39
PID 2848 wrote to memory of 2952	2848	MEMZ.exe	40
PID 2848 wrote to memory of 2952	2848	MEMZ.exe	40
PID 2848 wrote to memory of 2952	2848	MEMZ.exe	40
PID 2848 wrote to memory of 2952	2848	MEMZ.exe	40
PID 2848 wrote to memory of 2976	2848	MEMZ.exe	41
PID 2848 wrote to memory of 2976	2848	MEMZ.exe	41
PID 2848 wrote to memory of 2976	2848	MEMZ.exe	41
PID 2848 wrote to memory of 2976	2848	MEMZ.exe	41
PID 2976 wrote to memory of 3004	2976	MEMZ.exe	42
PID 2976 wrote to memory of 3004	2976	MEMZ.exe	42
PID 2976 wrote to memory of 3004	2976	MEMZ.exe	42
PID 2976 wrote to memory of 3004	2976	MEMZ.exe	42
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2444	940	iexplore.exe	43
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 940 wrote to memory of 2424	940	iexplore.exe	44
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2424 wrote to memory of 2500	2424	setup-gridinsoft-fix.exe	46
PID 2500 wrote to memory of 2468	2500	f69pTkh2.4pY	47
PID 2500 wrote to memory of 2468	2500	f69pTkh2.4pY	47
PID 2500 wrote to memory of 2468	2500	f69pTkh2.4pY	47
PID 2500 wrote to memory of 2468	2500	f69pTkh2.4pY	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\launcherfull-shiginima-v4400.exe
"C:\Users\Admin\AppData\Local\Temp\launcherfull-shiginima-v4400.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://java.com/download
  2⤵
  - Modifies Internet Explorer Phishing Filter
  - Modifies Internet Explorer settings
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:940 CREDAT:275457 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:672
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:940 CREDAT:603198 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2444
- - C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEOMB6VC\setup-gridinsoft-fix.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEOMB6VC\setup-gridinsoft-fix.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of WriteProcessMemory
    PID:2424
  - - C:\Users\Admin\AppData\Local\Temp\f69pTkh2.4pY
      C:\Users\Admin\AppData\Local\Temp\f69pTkh2.4pY /S /I /D=C:\Program Files\GridinSoft Anti-Malware\
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      Suspicious use of WriteProcessMemory
      PID:2500
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
        5⤵
        
        PID:2468
    - - C:\Windows\system32\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
        5⤵
        Drops file in Drivers directory
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2284
      - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        
        PID:2348
        
        C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:2384
    - - C:\Windows\system32\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
        5⤵
        Drops file in Drivers directory
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2456
      - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        
        PID:2428
        
        C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:2780
    - - C:\Windows\system32\RUNDLL32.EXE
        
        C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf
        5⤵
        Drops file in Drivers directory
        Adds Run key to start application
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2548
      - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        6⤵
        Checks processor information in registry
        
        PID:108
        
        C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        7⤵
        
        PID:2868
    - - C:\Windows\SysWOW64\regsvr32.exe
        
        "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
        5⤵
        Loads dropped DLL
        
        PID:1628
      - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
        6⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:1972
  - - C:\Program Files\GridinSoft Anti-Malware\gsam.exe
      "C:\Program Files\GridinSoft Anti-Malware\gsam.exe"
      4⤵
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2784

C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2960
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /watchdog
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp1_MEMZ 3.0 (1).zip\MEMZ 3.0\MEMZ.exe" /main
  2⤵
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\Windows\SysWOW64\notepad.exe
    "C:\Windows\System32\notepad.exe" \note.txt
    3⤵
    PID:3004

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Bootkit

T1067

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery