302ff52ee53fd6950b16d2a01ec8f52b69243b59941e813544adbf314b552bfd

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "0"	cmdebug.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	cmdebug.exe

Disables Task Manager via registry modification
evasion

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\J:	000.exe
File opened (read-only)	\??\L:	cmdebug.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	cmdebug.exe
File opened (read-only)	\??\S:	cmdebug.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	cmdebug.exe
File opened (read-only)	\??\Y:	cmdebug.exe
File opened (read-only)	\??\H:	000.exe
File opened (read-only)	\??\P:	cmdebug.exe
File opened (read-only)	\??\K:	cmdebug.exe
File opened (read-only)	\??\R:	cmdebug.exe
File opened (read-only)	\??\U:	000.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\I:	cmdebug.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\A:	000.exe
File opened (read-only)	\??\S:	000.exe
File opened (read-only)	\??\Y:	000.exe
File opened (read-only)	\??\H:	cmdebug.exe
File opened (read-only)	\??\O:	cmdebug.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	cmdebug.exe
File opened (read-only)	\??\S:	cmdebug.exe
File opened (read-only)	\??\L:	000.exe
File opened (read-only)	\??\B:	cmdebug.exe
File opened (read-only)	\??\A:	cmdebug.exe
File opened (read-only)	\??\G:	cmdebug.exe
File opened (read-only)	\??\P:	cmdebug.exe
File opened (read-only)	\??\B:	000.exe
File opened (read-only)	\??\G:	000.exe
File opened (read-only)	\??\U:	cmdebug.exe
File opened (read-only)	\??\Z:	cmdebug.exe
File opened (read-only)	\??\J:	cmdebug.exe
File opened (read-only)	\??\M:	000.exe
File opened (read-only)	\??\W:	cmdebug.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\E:	cmdebug.exe
File opened (read-only)	\??\T:	cmdebug.exe
File opened (read-only)	\??\Q:	000.exe
File opened (read-only)	\??\T:	cmdebug.exe
File opened (read-only)	\??\L:	cmdebug.exe
File opened (read-only)	\??\I:	cmdebug.exe
File opened (read-only)	\??\N:	cmdebug.exe
File opened (read-only)	\??\X:	000.exe
File opened (read-only)	\??\A:	cmdebug.exe
File opened (read-only)	\??\K:	cmdebug.exe
File opened (read-only)	\??\N:	cmdebug.exe
File opened (read-only)	\??\X:	cmdebug.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	cmdebug.exe
File opened (read-only)	\??\G:	cmdebug.exe
File opened (read-only)	\??\I:	000.exe
File opened (read-only)	\??\T:	000.exe
File opened (read-only)	\??\Z:	cmdebug.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\International\Geo\Nation	cmdebug.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\Control Panel\Desktop\Wallpaper	000.exe

Drops file in Program Files directory 57 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\JPSoft\CMDebug30\updater.ini	msiexec.exe
File opened for modification	C:\Program Files\JPSoft\CMDebug30\CMDebug.exception.log	CMDebug.exe
File created	C:\Program Files\JPSoft\CMDebug30\license.txt	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ipworksssh20.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\RussianR.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\BorlndMM.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\updater.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\SReplace.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\EnglishD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\GermanD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\RussianD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Styles\VisualStudio2017.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\SpanishD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\TC-ProcessEnv64.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\DebenuPDFLibrary64DLL1411.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ipworkszip20.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\readme.txt	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Russian.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\NSILP_PowerShell.x64.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\eViewer.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\IsLicense50.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Italian.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Lua54.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\regid.2002-09.com.jpsoft_898501d7-0cd8-4ee3-91c3-bb4afd3078f8.swidtag	MsiExec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Spanish.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\normal.fll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Lexilla.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ipworksbt20.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Styles\VisualStudio2022.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\takecmd.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\English.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\FrenchD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Styles\VisualStudio2015.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Styles\VisualStudio2012.dll	msiexec.exe
File opened for modification	C:\Program Files\JPSoft\CMDebug30\cmdebug.exception.log	cmdebug.exe
File created	C:\Program Files\JPSoft\CMDebug30\Onig.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\CMDebug.ewriter	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\GermanR.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\tcc.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\TC-ProcessEnv32.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\application.data	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\takecmd.tlb	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\TPipe.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\LookupErrors.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\FrenchR.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\cmdebug.30.key	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ItalianD.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ipworks20.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Styles\VisualStudio2019.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\EnglishR.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\SpanishR.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\French.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\German.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\CMDebug.exe	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\textpipeengine64.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\Scintilla.dll	msiexec.exe
File created	C:\Program Files\JPSoft\CMDebug30\ItalianR.dll	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\browsebutton	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\viewreadmebutton	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\viewreadmebutton.xaml	cmdebug.exe
File created	C:\Windows\Installer\e58a054.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICEBF.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\checkbox	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\repair.png.xaml	cmdebug.exe
File opened for modification	C:\Windows\SystemTemp\MSIF898.LOG	cmdebug.exe
File opened for modification	C:\Windows\Installer\MSICAF3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_min_down.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_caption_inactive.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_right.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_top_right.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_close_hot.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\backgroundprepare	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\New	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\remove.png.xaml	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\remove.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\background	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\exclamic	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_min_normal.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\info	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\metrobuttonimage	cmdebug.exe
File created	C:\Windows\Installer\{6C950498-B810-42D9-84B1-7F90F63D4AB6}\bugdelete_1.exe	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\whitebackground	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\metrorunapplicationbutton	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_min_inactive.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\print.png.xaml	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\repair.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_bottom_mid_inactive.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\insticon	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\runapplicationbutton	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\metrobuttonimage.xaml	cmdebug.exe
File opened for modification	C:\Windows\Installer\MSICE11.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\printico	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_bottom_mid.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_left.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_top_left.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_close_down.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\completi	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\Up	cmdebug.exe
File opened for modification	C:\Windows\Installer\MSIA7E5.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp\MSIF898.LOG	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_caption.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\ProgressImage.png	cmdebug.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB297.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID0C4.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_left_inactive.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\sys_close_normal.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\backbutton	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\repairic	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\print.png	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\waitlogoicon	cmdebug.exe
File opened for modification	C:\Windows\SystemTemp\MSIF898.LOG	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\optionslogoicon	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\modify.png.xaml	cmdebug.exe
File opened for modification	C:\Windows\Installer\e58a052.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA544.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB4EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICE7F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_bottom_right.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_top_left_inactive.bmp	cmdebug.exe
File created	C:\Windows\SystemTemp\AI_EXTUI_BIN_1392\frame_top_mid_inactive.bmp	cmdebug.exe

Executes dropped EXE 3 IoCs

pid	Process
3044	tcc.exe
4504	cmdebug.exe
5088	CMDebug.exe

Loads dropped DLL 64 IoCs

pid	Process
1392	cmdebug.exe
1392	cmdebug.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
1544	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
2784	MsiExec.exe
4332	MsiExec.exe
3844	MsiExec.exe
2784	MsiExec.exe
4332	MsiExec.exe
4332	MsiExec.exe
3044	tcc.exe
3044	tcc.exe
3044	tcc.exe
3044	tcc.exe
3044	tcc.exe
3044	tcc.exe
1544	MsiExec.exe
4504	cmdebug.exe
4504	cmdebug.exe
1544	MsiExec.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe

Registers COM server for autorun 1 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\InProcServer32\ = "C:\\Windows\\system32\\kernel32.dll"	cmdebug.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\InProcServer32	CMDebug.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\InProcServer32\ = "C:\\Windows\\system32\\kernel32.dll"	CMDebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32\ = "C:\\Program Files\\JPSoft\\CMDebug30\\IsLicense50.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\InProcServer32	cmdebug.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Kills process with taskkill 2 IoCs

evasion

pid	Process
5328	taskkill.exe
472	taskkill.exe

Modifies data under HKEY_USERS 19 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6C950498-B810-42D9-84B1-7F90F63D4AB6}\C:\ProgramData\regid.2002-09.com.jpsoft\regid.2002-09.com.jpsoft_898501d7-0cd8-4ee3-91c3-bb4afd3078f8.swidtag = "*"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon	MsiExec.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6C950498-B810-42D9-84B1-7F90F63D4AB6}\C:\Program Files\JPSoft\CMDebug30\regid.2002-09.com.jpsoft_898501d7-0cd8-4ee3-91c3-bb4afd3078f8.swidtag = "*"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}\MaxCapacity = "12287"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Caphyon\Advanced Installer\XML Config\{6C950498-B810-42D9-84B1-7F90F63D4AB6}	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{e5d54008-0000-0000-0000-d01200000000}	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\TypeLib\ = "{0474E6A3-6F13-4EE3-88F6-3E7E36367761}"	tcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IsLicense50.IsLicenseMgr.1\ = "IsLicenseMgr Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IsLicense50.IsLicenseMgr\ = "IsLicenseMgr Class"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\FLAGS	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\Insertable	CMDebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0474E6A3-6F13-4EE3-88F6-3E7E36367761}\18.0	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\HELPDIR\ = "C:\\Program Files\\JPSoft\\CMDebug30"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IsLicense50.IsLicenseMgr.1	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IsLicense50.IsLicenseMgr.1\CLSID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\ = "TCC_Scripting_1"	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\TypeLib	tcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\TypeLib\ = "{0474E6A3-6F13-4EE3-88F6-3E7E36367761}"	tcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\SourceList\Media\DiskPrompt = "[1]"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\TypeLib\Version = "18.0"	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0474E6A3-6F13-4EE3-88F6-3E7E36367761}\18.0\0	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32\ThreadingModel = "Both"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\TypeLib\Version = "1.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\ProductName = "CMDebug 30"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}	MsiExec.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\Transforms = ":3082"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\HELPDIR	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\Control\Control1 = "E\u0098àÌÊÅèËÝÈÈÅßÉÝÞëÅïÐåÌéÅËèÈÙÚðÛáàÄÊÊÅÈÏÅÊÈÊËÓ"	cmdebug.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	tcc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\InProcServer32	cmdebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\VersionIndependentProgID	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\TypeLib\ = "{8D732308-066E-4e85-9D5C-4410EB6BFDBC}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0474E6A3-6F13-4EE3-88F6-3E7E36367761}\18.0\HELPDIR\ = "C:\\Program Files\\JPSoft\\CMDebug30"	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\TypeLib	tcc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\icon.ico"	000.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\ = "IsLicenseMgr Class"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\ = "IsLicense 5.0 Type Library"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\894059C6018B9D24481BF7096FD3A46B	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\Insertable\ = "2414;16467"	cmdebug.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\InprocServer32\ = "C:\\Program Files\\JPSoft\\CMDebug30\\IsLicense50.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\894059C6018B9D24481BF7096FD3A46B\AI64BitFiles	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Roaming\\JP Software\\CMDebug 30 30.0.22.0\\install\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID	cmdebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\0	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32	MsiExec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0474E6A3-6F13-4EE3-88F6-3E7E36367762}\ProxyStubClsid32	tcc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\CLSID\{c4fadf6d-fb7e-43bd-8a1f-3ce624b21b77}\Control	cmdebug.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{8D732308-066E-4E85-9D5C-4410EB6BFDBC}\1.0\FLAGS\ = "0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3C4ABAB8-F6D3-4BC3-922D-43715A228CC2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\894059C6018B9D24481BF7096FD3A46B\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Roaming\\JP Software\\CMDebug 30 30.0.22.0\\install\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0474E6A3-6F13-4EE3-88F6-3E7E36367761}\18.0\HELPDIR	tcc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D7C6C53B-C335-417f-ABB8-F5A157F92EA0}\TypeLib	MsiExec.exe

Modifies system certificate store 2 TTPs 9 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cmdebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43	cmdebug.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	cmdebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	cmdebug.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2	cmdebug.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800001900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cmdebug.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	cmdebug.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cmdebug.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef453000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	cmdebug.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\000.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3044	tcc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3860	msiexec.exe
3860	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	3860	msiexec.exe
Token: SeCreateTokenPrivilege	1392	cmdebug.exe
Token: SeAssignPrimaryTokenPrivilege	1392	cmdebug.exe
Token: SeLockMemoryPrivilege	1392	cmdebug.exe
Token: SeIncreaseQuotaPrivilege	1392	cmdebug.exe
Token: SeMachineAccountPrivilege	1392	cmdebug.exe
Token: SeTcbPrivilege	1392	cmdebug.exe
Token: SeSecurityPrivilege	1392	cmdebug.exe
Token: SeTakeOwnershipPrivilege	1392	cmdebug.exe
Token: SeLoadDriverPrivilege	1392	cmdebug.exe
Token: SeSystemProfilePrivilege	1392	cmdebug.exe
Token: SeSystemtimePrivilege	1392	cmdebug.exe
Token: SeProfSingleProcessPrivilege	1392	cmdebug.exe
Token: SeIncBasePriorityPrivilege	1392	cmdebug.exe
Token: SeCreatePagefilePrivilege	1392	cmdebug.exe
Token: SeCreatePermanentPrivilege	1392	cmdebug.exe
Token: SeBackupPrivilege	1392	cmdebug.exe
Token: SeRestorePrivilege	1392	cmdebug.exe
Token: SeShutdownPrivilege	1392	cmdebug.exe
Token: SeDebugPrivilege	1392	cmdebug.exe
Token: SeAuditPrivilege	1392	cmdebug.exe
Token: SeSystemEnvironmentPrivilege	1392	cmdebug.exe
Token: SeChangeNotifyPrivilege	1392	cmdebug.exe
Token: SeRemoteShutdownPrivilege	1392	cmdebug.exe
Token: SeUndockPrivilege	1392	cmdebug.exe
Token: SeSyncAgentPrivilege	1392	cmdebug.exe
Token: SeEnableDelegationPrivilege	1392	cmdebug.exe
Token: SeManageVolumePrivilege	1392	cmdebug.exe
Token: SeImpersonatePrivilege	1392	cmdebug.exe
Token: SeCreateGlobalPrivilege	1392	cmdebug.exe
Token: SeCreateTokenPrivilege	1392	cmdebug.exe
Token: SeAssignPrimaryTokenPrivilege	1392	cmdebug.exe
Token: SeLockMemoryPrivilege	1392	cmdebug.exe
Token: SeIncreaseQuotaPrivilege	1392	cmdebug.exe
Token: SeMachineAccountPrivilege	1392	cmdebug.exe
Token: SeTcbPrivilege	1392	cmdebug.exe
Token: SeSecurityPrivilege	1392	cmdebug.exe
Token: SeTakeOwnershipPrivilege	1392	cmdebug.exe
Token: SeLoadDriverPrivilege	1392	cmdebug.exe
Token: SeSystemProfilePrivilege	1392	cmdebug.exe
Token: SeSystemtimePrivilege	1392	cmdebug.exe
Token: SeProfSingleProcessPrivilege	1392	cmdebug.exe
Token: SeIncBasePriorityPrivilege	1392	cmdebug.exe
Token: SeCreatePagefilePrivilege	1392	cmdebug.exe
Token: SeCreatePermanentPrivilege	1392	cmdebug.exe
Token: SeBackupPrivilege	1392	cmdebug.exe
Token: SeRestorePrivilege	1392	cmdebug.exe
Token: SeShutdownPrivilege	1392	cmdebug.exe
Token: SeDebugPrivilege	1392	cmdebug.exe
Token: SeAuditPrivilege	1392	cmdebug.exe
Token: SeSystemEnvironmentPrivilege	1392	cmdebug.exe
Token: SeChangeNotifyPrivilege	1392	cmdebug.exe
Token: SeRemoteShutdownPrivilege	1392	cmdebug.exe
Token: SeUndockPrivilege	1392	cmdebug.exe
Token: SeSyncAgentPrivilege	1392	cmdebug.exe
Token: SeEnableDelegationPrivilege	1392	cmdebug.exe
Token: SeManageVolumePrivilege	1392	cmdebug.exe
Token: SeImpersonatePrivilege	1392	cmdebug.exe
Token: SeCreateGlobalPrivilege	1392	cmdebug.exe
Token: SeCreateTokenPrivilege	1392	cmdebug.exe
Token: SeAssignPrimaryTokenPrivilege	1392	cmdebug.exe
Token: SeLockMemoryPrivilege	1392	cmdebug.exe
Token: SeIncreaseQuotaPrivilege	1392	cmdebug.exe
Token: SeMachineAccountPrivilege	1392	cmdebug.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1392	cmdebug.exe
1392	cmdebug.exe
3044	tcc.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
3044	tcc.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
4504	cmdebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
5088	CMDebug.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe
2528	firefox.exe
4336	000.exe
4336	000.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 1544	3860	msiexec.exe	90
PID 3860 wrote to memory of 1544	3860	msiexec.exe	90
PID 3860 wrote to memory of 1544	3860	msiexec.exe	90
PID 1392 wrote to memory of 460	1392	cmdebug.exe	98
PID 1392 wrote to memory of 460	1392	cmdebug.exe	98
PID 1392 wrote to memory of 460	1392	cmdebug.exe	98
PID 3860 wrote to memory of 2784	3860	msiexec.exe	99
PID 3860 wrote to memory of 2784	3860	msiexec.exe	99
PID 3860 wrote to memory of 2784	3860	msiexec.exe	99
PID 3860 wrote to memory of 4332	3860	msiexec.exe	100
PID 3860 wrote to memory of 4332	3860	msiexec.exe	100
PID 3860 wrote to memory of 4332	3860	msiexec.exe	100
PID 3860 wrote to memory of 3844	3860	msiexec.exe	101
PID 3860 wrote to memory of 3844	3860	msiexec.exe	101
PID 3860 wrote to memory of 3044	3860	msiexec.exe	104
PID 3860 wrote to memory of 3044	3860	msiexec.exe	104
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 3296 wrote to memory of 2528	3296	firefox.exe	121
PID 2528 wrote to memory of 2232	2528	firefox.exe	122
PID 2528 wrote to memory of 2232	2528	firefox.exe	122
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123
PID 2528 wrote to memory of 1736	2528	firefox.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\cmdebug.exe
"C:\Users\Admin\AppData\Local\Temp\cmdebug.exe"
1⤵
- Enumerates connected drives
- Checks computer location settings
- Drops file in Windows directory
- Loads dropped DLL
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\cmdebug.exe
  "C:\Users\Admin\AppData\Local\Temp\cmdebug.exe" /i "C:\Users\Admin\AppData\Roaming\JP Software\CMDebug 30 30.0.22.0\install\cmdebug.msi" AI_EUIMSI=1 SHORTCUTDIR="C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CMDebug30" APPDIR="C:\Program Files\JPSoft\CMDebug30" SECONDSEQUENCE="1" CLIENTPROCESSID="1392" CHAINERUIPROCESSID="1392Chainer" ACTION="INSTALL" EXECUTEACTION="INSTALL" CLIENTUILEVEL="0" ADDLOCAL="AI64BitFiles,AIOtherFiles,MainFeature" AGREE_CHECKBOX="Yes" PRIMARYFOLDER="APPDIR" ROOTDRIVE="F:\" TRANSFORMS=":3082" AI_LOGFILELOCATION="C:\Windows\SystemTemp\MSIF898.LOG" AI_DETECTED_PRIVILEGED="1" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\cmdebug.exe" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\" EXE_CMD_LINE="/exenoupdates /forcecleanup /wintime 1689745663 " AI_CONTROL_VISUAL_STYLE="15925239;15138798;10395294;4108658" AI_SETUPEXEPATH_ORIGINAL="C:\Users\Admin\AppData\Local\Temp\cmdebug.exe" TARGETDIR="F:\" AI_INSTALL="1"
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - Modifies system certificate store
  PID:460

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding FB5A3250280C77346A7AA15733091148 C
  2⤵
  - Loads dropped DLL
  PID:1544
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DB8EA2E3491844F5075F3EB6E7CC3738
  2⤵
  - Loads dropped DLL
  PID:2784
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F2F4F95B579BCF9CA1B85CA37C755437 E Global\MSI0000
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Program Files directory
  - Loads dropped DLL
  - Modifies data under HKEY_USERS
  PID:4332
- C:\Windows\System32\MsiExec.exe
  "C:\Windows\System32\MsiExec.exe" /Y "C:\Program Files\JPSoft\CMDebug30\IsLicense50.dll"
  2⤵
  - Loads dropped DLL
  - Registers COM server for autorun
  - Modifies registry class
  PID:3844
- C:\Program Files\JPSoft\CMDebug30\tcc.exe
  "C:\Program Files\JPSoft\CMDebug30\tcc.exe" /c toast /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3044

C:\Program Files\JPSoft\CMDebug30\cmdebug.exe
"C:\Program Files\JPSoft\CMDebug30\cmdebug.exe"
1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4504

C:\Program Files\JPSoft\CMDebug30\CMDebug.exe
"C:\Program Files\JPSoft\CMDebug30\CMDebug.exe"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2528
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.0.1809152409\2032808369" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 20860 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ecbc78b-84b8-42f6-b937-234cf4b04867} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 1960 1c8dafef358 gpu
    3⤵
    PID:2232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.1.901707529\1007147347" -parentBuildID 20221007134813 -prefsHandle 2332 -prefMapHandle 2328 -prefsLen 20896 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1049d6b7-a9c6-4841-9e3d-c98d153ef22f} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 2360 1c8da944158 socket
    3⤵
    PID:1736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.2.1165045297\384966096" -childID 1 -isForBrowser -prefsHandle 3336 -prefMapHandle 3332 -prefsLen 20999 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {addf7c25-abac-4019-814b-518df1aed25d} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 3036 1c8deed0958 tab
    3⤵
    PID:3256
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.3.1543069107\529376717" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26359 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {171dc246-f2fe-4f3c-861b-eb78c9d643de} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 3608 1c8ce662b58 tab
    3⤵
    PID:5056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.4.1665818123\180893206" -childID 3 -isForBrowser -prefsHandle 4164 -prefMapHandle 4152 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f349182b-11aa-4a95-93d2-fe77ac2d8228} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 4180 1c8ce669f58 tab
    3⤵
    PID:3540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.5.1664716488\1284169831" -childID 4 -isForBrowser -prefsHandle 4964 -prefMapHandle 3980 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92d9e0bb-4bde-422e-bb13-8f1c20dfc1d0} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 4952 1c8dd740858 tab
    3⤵
    PID:4404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.7.1710438392\1005595789" -childID 6 -isForBrowser -prefsHandle 5292 -prefMapHandle 5288 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b0906da-4d20-4e4f-8c02-3a9544641d88} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 5304 1c8e09e0b58 tab
    3⤵
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.6.1486304016\138454150" -childID 5 -isForBrowser -prefsHandle 4816 -prefMapHandle 4924 -prefsLen 26418 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e6c96f0f-847d-4f7a-a2f2-c8197bbd83c7} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 5024 1c8e0608958 tab
    3⤵
    PID:3192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.8.1899726666\278219936" -childID 7 -isForBrowser -prefsHandle 6040 -prefMapHandle 4364 -prefsLen 30064 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab5dc373-0227-48ec-943f-40d0f78b2c93} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 6012 1c8e9f1d058 tab
    3⤵
    PID:4156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.9.694566415\134978563" -childID 8 -isForBrowser -prefsHandle 5860 -prefMapHandle 6216 -prefsLen 30064 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d23b143e-3ba9-4894-9d3f-b9d0bf6475cb} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 6212 1c8eaff6058 tab
    3⤵
    PID:3304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.10.2109691968\1355353723" -parentBuildID 20221007134813 -prefsHandle 6380 -prefMapHandle 6384 -prefsLen 30064 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d2246260-0893-4b9d-880f-85091cbff473} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 6376 1c8eb2efb58 rdd
    3⤵
    PID:920
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2528.11.1981659085\293831962" -childID 9 -isForBrowser -prefsHandle 6100 -prefMapHandle 4524 -prefsLen 30064 -prefMapSize 232645 -jsInitHandle 1080 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {393e8f1f-0660-48fe-b90c-0770d6abfaf0} 2528 "\\.\pipe\gecko-crash-server-pipe.2528" 4176 1c8e4365b58 tab
    3⤵
    PID:5464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6080

C:\Users\Admin\Downloads\000\000.exe
"C:\Users\Admin\Downloads\000\000.exe"
1⤵
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\windl.bat""
  2⤵
  PID:5240
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - Kills process with taskkill
    PID:5328
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im taskmgr.exe
    3⤵
    - Kills process with taskkill
    PID:472
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' set FullName='UR NEXT'
    3⤵
    PID:5428
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic useraccount where name='Admin' rename 'UR NEXT'
    3⤵
    PID:5536
- - C:\Windows\SysWOW64\shutdown.exe
    shutdown /f /r /t 0
    3⤵
    PID:4696

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391e855 /state1:0x41c64e6d
1⤵
PID:5620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery