f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	[email protected]

Drops file in Drivers directory 4 IoCs

Processes:

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\system32\drivers\etc\hosts	[email protected]
File created	C:\Windows\system32\drivers\etc\host_new	[email protected]
File created	C:\Windows\System32\drivers\etc\hosts	[email protected]

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbb.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gator.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nt.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootconf.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmgt.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onsrvr.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvcl.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blss.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PavFnSvr.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intren.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keenvalue.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe\Debugger = "svchost.exe"	[email protected]

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\7ec1c\\IS559.exe\" /s /d"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows\CurrentVersion\Run	[email protected]
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	[email protected]
Key deleted	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	[email protected]

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

[email protected]

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ [email protected]
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	[email protected]

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

description	ioc	process
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\T:	[email protected]

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

[email protected]

description ioc process

File opened for modification \??\PhysicalDrive0 [email protected]
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	[email protected]

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "23367"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0"	[email protected]

Modifies data under HKEY_USERS 6 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]

Modifies registry class 15 IoCs

Processes:

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\[email protected]"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\ = "Implements DocHostUIHandler"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "[email protected]"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

pid	process
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]
3356	[email protected]

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mofcomp.exe

description pid process

Token: SeSecurityPrivilege 5064 mofcomp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

[email protected]

pid process

3356 [email protected]
3356 [email protected]
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

[email protected]

pid process

3356 [email protected]
3356 [email protected]
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

[email protected]

pid process

3356 [email protected]
3356 [email protected]

description	pid	process
Token: SeSecurityPrivilege	5064	mofcomp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

description	pid	process	target process
PID 3356 wrote to memory of 5064	3356	[email protected]	mofcomp.exe
PID 3356 wrote to memory of 5064	3356	[email protected]	mofcomp.exe
PID 3356 wrote to memory of 5064	3356	[email protected]	mofcomp.exe
PID 3356 wrote to memory of 3932	3356	[email protected]	netsh.exe
PID 3356 wrote to memory of 3932	3356	[email protected]	netsh.exe
PID 3356 wrote to memory of 3932	3356	[email protected]	netsh.exe
PID 3356 wrote to memory of 224	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 224	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 224	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4048	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4048	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4048	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1232	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1232	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1232	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4180	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4180	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4180	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3876	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3876	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3876	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3820	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3820	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3820	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3504	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3504	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3504	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 496	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 496	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 496	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4376	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4376	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4376	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4144	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4144	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4144	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1544	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1544	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1544	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1556	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1556	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1556	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1052	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1052	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1052	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1280	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1280	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 1280	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4412	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4412	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4412	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3952	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3952	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3952	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3660	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3660	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 3660	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4540	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4540	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4540	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4308	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4308	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4308	3356	[email protected]	nslookup.exe
PID 3356 wrote to memory of 4656	3356	[email protected]	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\[email protected]
"C:\Users\Admin\AppData\Local\Temp\[email protected]"
1⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\AppData\Local\Temp\8463.mof"
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5064
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\[email protected]" "Internet Security Guard" ENABLE
  2⤵
  PID:3932
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.com 8.8.8.8
  2⤵
  PID:224
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.net 8.8.8.8
  2⤵
  PID:4048
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.com 208.67.222.222
  2⤵
  PID:1232
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.net 208.67.222.222
  2⤵
  PID:4180
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.com 8.8.4.4
  2⤵
  PID:3876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.net 8.8.4.4
  2⤵
  PID:3820
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.com 208.67.220.220
  2⤵
  PID:3504
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt cjru459cdmsvzbd.net 208.67.220.220
  2⤵
  PID:496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.com 8.8.8.8
  2⤵
  PID:4376
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.net 8.8.8.8
  2⤵
  PID:4144
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.com 208.67.222.222
  2⤵
  PID:1544
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.net 208.67.222.222
  2⤵
  PID:1556
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.com 8.8.4.4
  2⤵
  PID:1052
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.net 8.8.4.4
  2⤵
  PID:1280
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.com 208.67.220.220
  2⤵
  PID:4412
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt lmn187nwcjjmttcd.net 208.67.220.220
  2⤵
  PID:3952
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.com 8.8.8.8
  2⤵
  PID:3660
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.net 8.8.8.8
  2⤵
  PID:4540
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.com 208.67.222.222
  2⤵
  PID:4308
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.net 208.67.222.222
  2⤵
  PID:4656
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.com 8.8.4.4
  2⤵
  PID:4652
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.net 8.8.4.4
  2⤵
  PID:3104
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.com 208.67.220.220
  2⤵
  PID:1008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt jnuxfmopyej1598l.net 208.67.220.220
  2⤵
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry