hxxp://download[.]com

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SASDIFSV\ImagePath = "\\??\\C:\\Program Files\\SUPERAntiSpyware\\SASDIFSV64.SYS"	SUPERAntiSpyware.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SASKUTIL\ImagePath = "\\??\\C:\\Program Files\\SUPERAntiSpyware\\SASKUTIL64.SYS"	SUPERAntiSpyware.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	SUPERAntiSpyware.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	SUPERAntiSpyware.exe

Executes dropped EXE 8 IoCs

pid	Process
5536	SUPERAntiSpyware.exe
5692	SUPERAntiSpyware.exe
496	SASCORE64.EXE
5340	SASCORE64.EXE
2840	SUPERAntiSpyware.exe
5288	SSUPDATE64.EXE
3076	SUPERAntiSpyware.exe
2576	SSUPDATE64.EXE

Loads dropped DLL 5 IoCs

pid	Process
5536	SUPERAntiSpyware.exe
5536	SUPERAntiSpyware.exe
3196	REGSVR32.EXE
5380	regsvr32.exe
5536	SUPERAntiSpyware.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32\ = "C:\\Program Files\\SUPERAntiSpyware\\SASCTXMN64.DLL"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SUPERAntiSpyware = "C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"	SUPERAntiSpyware.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Software\Microsoft\Windows\CurrentVersion\Run	SUPERAntiSpyware.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 23 IoCs

description	ioc	Process
File created	C:\Program Files\SUPERAntiSpyware\SASTask.exe	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SAS Default.set	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\High Contrast Black.set	SUPERAntiSpyware.exe
File opened for modification	C:\Program Files\SUPERAntiSpyware\Uninstall.dat	SUPERAntiSpyware.exe
File opened for modification	C:\Program Files\SUPERAntiSpyware\sas_preconfig.db3	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SUPERDelete.exe	SUPERAntiSpyware.exe
File opened for modification	C:\Program Files\SUPERAntiSpyware\Uninstall.dat-journal	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SASCore64.exe	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\sasdifsv64.sys	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\Uninstall.exe	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\sas_enum_cookies.exe	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\detect.wav	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\msvcr71.dll	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\Plugins\sab_incr.dll	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\Plugins\sab_wab.dll	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\saskutil64.sys	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SAS_Preconfig.db3	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\RUNSAS.EXE	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SASREPAIRS.STG	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\Plugins\sab_mapi.dll	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SASCTXMN64.DLL	SUPERAntiSpyware.exe
File created	C:\Program Files\SUPERAntiSpyware\SSUpdate64.exe	SUPERAntiSpyware.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 8 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	SUPERAntiSpyware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	SUPERAntiSpyware.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	SUPERAntiSpyware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	SUPERAntiSpyware.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	SUPERAntiSpyware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	SUPERAntiSpyware.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	SUPERAntiSpyware.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	SUPERAntiSpyware.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{746C91D0-C4A9-460A-B841-851A2B6F2C4B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SASCTXMN.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte\ = "SASContextMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\0\win64\ = "C:\\Program Files\\SUPERAntiSpyware\\SASCTXMN64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{746C91D0-C4A9-460A-B841-851A2B6F2C4B}\ = "SUPERAntiSpywareContextMenuExtension"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ = "SUPERAntiSpyware Context Menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\VersionIndependentProgID\ = "SUPERAntiSpywareContextMenuExt.SASConte"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\MiscStatus	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\Version\ = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\MiscStatus\1\ = "131473"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ = "ISASContextMenu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte\CLSID\ = "{CA8ACAFA-5FBB-467B-B348-90DD488DE003}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\TypeLib\ = "{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib\ = "{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\SASCTXMN.DLL\AppID = "{746C91D0-C4A9-460A-B841-851A2B6F2C4B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1\ = "SASContextMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\MiscStatus\1	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ = "SUPERAntiSpyware Context Menu"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte\CurVer\ = "SUPERAntiSpywareContextMenuExt.SASCon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\0\win64	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1\CLSID\ = "{CA8ACAFA-5FBB-467B-B348-90DD488DE003}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ = "ISASContextMenu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\Control	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\ = "SUPERAntiSpywareContextMenuExtension 1.0 Type Library"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AllFilesystemObjects\shellex\ContextMenuHandlers\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ = "SUPERAntiSpyware Context Menu"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASConte\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\HELPDIR\ = "C:\\Program Files\\SUPERAntiSpyware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\InprocServer32\ = "C:\\Program Files\\SUPERAntiSpyware\\SASCTXMN64.DLL"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ToolboxBitmap32\ = "C:\\Program Files\\SUPERAntiSpyware\\SASCTXMN64.DLL, 102"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ProgID\ = "SUPERAntiSpywareContextMenuExt.SASCon.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib\ = "{209D651D-9AAE-47B4-AD74-16A8F03ACDDB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ = "SASContextMenu Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CA8ACAFA-5FBB-467B-B348-90DD488DE003}\ToolboxBitmap32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A42DCBB4-CBAE-4593-BB45-39CAD8F2CF19}\TypeLib	regsvr32.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 613077.crdownload:SmartScreen	msedge.exe

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	298	SASDef_GetComponentsDescriptor
HTTP User-Agent header	298	SASDef_GetDescriptor

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4840	msedge.exe
4840	msedge.exe
1748	identity_helper.exe
1748	identity_helper.exe
4364	msedge.exe
4364	msedge.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: 33	5184	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5184	AUDIODG.EXE
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeTakeOwnershipPrivilege	5536	SUPERAntiSpyware.exe
Token: SeDebugPrivilege	5288	SSUPDATE64.EXE
Token: SeDebugPrivilege	2840	SUPERAntiSpyware.exe
Token: SeDebugPrivilege	2840	SUPERAntiSpyware.exe
Token: 33	2840	SUPERAntiSpyware.exe
Token: SeIncBasePriorityPrivilege	2840	SUPERAntiSpyware.exe
Token: SeDebugPrivilege	2576	SSUPDATE64.EXE
Token: SeDebugPrivilege	3076	SUPERAntiSpyware.exe
Token: SeDebugPrivilege	3076	SUPERAntiSpyware.exe
Token: 33	2840	SUPERAntiSpyware.exe
Token: SeIncBasePriorityPrivilege	2840	SUPERAntiSpyware.exe
Token: 33	2840	SUPERAntiSpyware.exe
Token: SeIncBasePriorityPrivilege	2840	SUPERAntiSpyware.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
5692	SUPERAntiSpyware.exe
4840	msedge.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
2840	SUPERAntiSpyware.exe
4280	firefox.exe
4280	firefox.exe
4280	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4280	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 3408	4840	msedge.exe	84
PID 4840 wrote to memory of 3408	4840	msedge.exe	84
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 1064	4840	msedge.exe	87
PID 4840 wrote to memory of 4728	4840	msedge.exe	88
PID 4840 wrote to memory of 4728	4840	msedge.exe	88
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89
PID 4840 wrote to memory of 3064	4840	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://download.com
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7cd946f8,0x7fff7cd94708,0x7fff7cd94718
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2204 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3900 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1296 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7244 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2144,17040708680488220160,9808979073937219583,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4364
- C:\Users\Admin\Downloads\SUPERAntiSpyware.exe
  "C:\Users\Admin\Downloads\SUPERAntiSpyware.exe"
  2⤵
  - Sets service image path in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:5536
- - C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
    "C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE" -install -name:!SASCORE -display:"SAS Core Service" -description:"SUPERAntiSpyware Core Service" -pipe:sascoreservicepipe
    3⤵
    - Executes dropped EXE
    PID:496
- - C:\Windows\SysWOW64\REGSVR32.EXE
    "C:\Windows\system32\REGSVR32.EXE" /s "C:\Program Files\SUPERAntiSpyware\SASCTXMN64.DLL"
    3⤵
    - Loads dropped DLL
    PID:3196
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files\SUPERAntiSpyware\SASCTXMN64.DLL"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      Modifies registry class
      PID:5380
- - C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Checks SCSI registry key(s)
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:2840
  - - C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE
      "C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE" *8.0.1052!{0D3C4F0D-1C11-47bc-AD1C-BAB98712DBFB}
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:5288
- C:\Users\Admin\Downloads\SUPERAntiSpyware.exe
  "C:\Users\Admin\Downloads\SUPERAntiSpyware.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of FindShellTrayWindow
  PID:5692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:380

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2ec 0x508
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5184

C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
"C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE"
1⤵
- Executes dropped EXE
PID:5340

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
"C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3076
- C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE
  "C:\Program Files\SUPERAntiSpyware\SSUPDATE64.EXE" *8.0.1052!{0D3C4F0D-1C11-47bc-AD1C-BAB98712DBFB}
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2576

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5804
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4280
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.0.569943286\1255516510" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1852 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6a3250a-86ab-4ef9-b491-ee889946fe02} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 1968 198e8acf158 gpu
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.1.496996398\518888404" -parentBuildID 20221007134813 -prefsHandle 2324 -prefMapHandle 2320 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5b10d3b-0f4d-450b-b519-ea1e329e1249} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 2356 198e8239a58 socket
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.2.1167874856\1090666666" -childID 1 -isForBrowser -prefsHandle 2996 -prefMapHandle 2968 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b4b6580e-4078-4e50-b1eb-95173138f4e3} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 3112 198ec897258 tab
    3⤵
    PID:716
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.3.967567881\571845992" -childID 2 -isForBrowser -prefsHandle 3584 -prefMapHandle 3580 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6c7b1a8c-ef91-4e77-a5bc-8a71cc9b1e4b} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 3592 198dbe62858 tab
    3⤵
    PID:3248
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.4.650650526\579871597" -childID 3 -isForBrowser -prefsHandle 4320 -prefMapHandle 4344 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {91df52ca-54b1-432c-9e75-04462ddc3a33} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 4324 198edcf1458 tab
    3⤵
    PID:3288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.5.803968696\1235815780" -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5212 -prefsLen 26497 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4130c10e-abef-4795-a5fa-c6b88dd86cec} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5128 198eedacb58 tab
    3⤵
    PID:4188
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.6.1156911573\1883709590" -childID 5 -isForBrowser -prefsHandle 5416 -prefMapHandle 5412 -prefsLen 26497 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7f0edc-3708-4b95-a8c8-05dc6a1f26db} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5236 198dbe61058 tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.7.359430805\697198678" -childID 6 -isForBrowser -prefsHandle 5400 -prefMapHandle 5344 -prefsLen 26497 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8af2204e-9f9d-44d0-8dcb-c1e0155cf001} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5388 198efd1cb58 tab
    3⤵
    PID:2144
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.8.1760154484\1691526167" -childID 7 -isForBrowser -prefsHandle 5804 -prefMapHandle 5808 -prefsLen 26672 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {08558776-a3c9-4e58-a6b3-65798a9d8077} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 5820 198eedba058 tab
    3⤵
    PID:2292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4280.9.1842141405\300668897" -childID 8 -isForBrowser -prefsHandle 6020 -prefMapHandle 5336 -prefsLen 26672 -prefMapSize 232645 -jsInitHandle 1084 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {36970b82-9683-427b-8b50-d59c38034a21} 4280 "\\.\pipe\gecko-crash-server-pipe.4280" 6016 198dbe61058 tab
    3⤵
    PID:2728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery