27052339536a08543f16b5fa0deb4ce554a70b697b27ee0143302d7e6ec4fe2f

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Modifies Installed Components in the registry 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

Drops desktop.ini file(s) 27 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3499517378-2376672570-1134980332-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Users\Triage\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Triage\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Triage\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Saved Games\desktop.ini	regsvr32.exe
File created	C:\Users\Triage\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Triage\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Triage\Downloads\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\Triage\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\Triage\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\26	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEPropFontName = "Plantagenet Cherokee"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Show_ToolBar = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\SOFTWARE\Microsoft\Internet Explorer\Security	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Settings\Background Color = "192,192,192"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Mangal"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\15	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\33\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\37	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Show_FullURL = "no"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\IETld	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\8	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\11\IEFixedFontName = "Shonar Bangla"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\XMLHTTP = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\4	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\24\IEFixedFontName = "MS Gothic"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\7	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\16\IEFixedFontName = "Vani"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Euphemia"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\SOFTWARE\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\NoUpdateCheck = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\IntelliForms	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\LowRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\7\IEPropFontName = "Sylfaen"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\13	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\14	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\28	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Document Windows\x = 00000080	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\24	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Do404Search = 01000000	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\19\IEFixedFontName = "Cordia New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\27\IEFixedFontName = "Nyala"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\28\IEFixedFontName = "Euphemia"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Document Windows\height = 00000000	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Security\Safety Warning Level = "Query"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\27\IEPropFontName = "Nyala"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\35\IEPropFontName = "Estrangelo Edessa"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\SOFTWARE\Microsoft\Internet Explorer\Services	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Search Page = "http://go.microsoft.com/fwlink/?LinkId=54896"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Settings\Anchor Color Visited = "128,0,128"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = 200364675d88d901	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Desktop\General	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\30\IEFixedFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\International\Scripts\39	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Local Page = "C:\\Windows\\system32\\blank.htm"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\SOFTWARE\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wms\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2t\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmx\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\midi/mid	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.dvr-ms\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wma	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmz	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-msvideo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DVD\shell\play\Command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADT\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmd\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.WMS\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mp4	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wm\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DVD\Shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpe\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS\shell\open	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mid	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers	unregmp2.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

description	pid	Process
Token: SeShutdownPrivilege	540	LogonUI.exe
Token: SeSecurityPrivilege	1620	winlogon.exe
Token: SeBackupPrivilege	1620	winlogon.exe
Token: SeSecurityPrivilege	1620	winlogon.exe
Token: SeTcbPrivilege	1620	winlogon.exe
Token: SeManageVolumePrivilege	1408	WinMail.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1700	ie4uinit.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeRestorePrivilege	1472	rundll32.exe
Token: SeManageVolumePrivilege	1936	WinMail.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1408	WinMail.exe
1936	WinMail.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 576	564	cmd.exe	31
PID 564 wrote to memory of 576	564	cmd.exe	31
PID 564 wrote to memory of 576	564	cmd.exe	31
PID 576 wrote to memory of 268	576	net.exe	32
PID 576 wrote to memory of 268	576	net.exe	32
PID 576 wrote to memory of 268	576	net.exe	32
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1620 wrote to memory of 540	1620	winlogon.exe	36
PID 1620 wrote to memory of 540	1620	winlogon.exe	36
PID 1620 wrote to memory of 540	1620	winlogon.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 540	1648	csrss.exe	36
PID 1648 wrote to memory of 672	1648	csrss.exe	39
PID 1648 wrote to memory of 672	1648	csrss.exe	39
PID 1620 wrote to memory of 672	1620	winlogon.exe	39
PID 1620 wrote to memory of 672	1620	winlogon.exe	39
PID 1620 wrote to memory of 672	1620	winlogon.exe	39
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 672 wrote to memory of 2024	672	userinit.exe	41
PID 672 wrote to memory of 2024	672	userinit.exe	41
PID 672 wrote to memory of 2024	672	userinit.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 2024	1648	csrss.exe	41
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 2024 wrote to memory of 1708	2024	Explorer.EXE	42
PID 2024 wrote to memory of 1708	2024	Explorer.EXE	42
PID 2024 wrote to memory of 1708	2024	Explorer.EXE	42
PID 2024 wrote to memory of 1708	2024	Explorer.EXE	42
PID 2024 wrote to memory of 1708	2024	Explorer.EXE	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1600	1648	csrss.exe	43
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1708	1648	csrss.exe	42
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 2024 wrote to memory of 1476	2024	Explorer.EXE	44
PID 2024 wrote to memory of 1476	2024	Explorer.EXE	44
PID 2024 wrote to memory of 1476	2024	Explorer.EXE	44
PID 2024 wrote to memory of 1476	2024	Explorer.EXE	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1476	1648	csrss.exe	44
PID 1648 wrote to memory of 1408	1648	csrss.exe	45

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\bee movie script"
1⤵
PID:1308

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Windows\system32\net.exe
  net user /add Triage
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user /add Triage
    3⤵
    PID:268

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1648

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:540
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Modifies Installed Components in the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:2024
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:1708
  - - C:\Program Files (x86)\Windows Mail\WinMail.exe
      "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Drops desktop.ini file(s)
      PID:1476
    - - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
        5⤵
        Drops desktop.ini file(s)
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1408
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Enumerates connected drives
      Modifies registry class
      PID:1064
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:1052
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
      4⤵
      PID:1936
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -UserConfig
      4⤵
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of AdjustPrivilegeToken
      PID:1700
    - - C:\Windows\System32\ie4uinit.exe
        
        C:\Windows\System32\ie4uinit.exe -ClearIconCache
        5⤵
        
        PID:1720
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
        5⤵
        Drops file in Windows directory
        Modifies Internet Explorer settings
        Suspicious use of AdjustPrivilegeToken
        
        PID:1472
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
        5⤵
        
        PID:268
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:1580
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Sets desktop wallpaper using registry
      PID:1472
  - - C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1936

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1148

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1600

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1604

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

T1158

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery