f1bbcc5c678d174d858ae089f4494e3ea8bcfc418098d61804a15e437f08aff7

max time kernel
158s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
24-07-2023 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Endermanch@InternetSecurityGuard.exe
Size

6.1MB
MD5

04155ed507699b4e37532e8371192c0b
SHA1

a14107131237dbb0df750e74281c462a2ea61016
SHA256

b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77
SHA512

6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371
SSDEEP

98304:hvOOFJ+Z8eAgy7SH9s76RSvyqJOBgECfMfYv+85JH0DVczt8A:hvOOFJ+ggr9s76R+wcMAv+IHCczt8

Score

9^/10

bootkit discovery evasion persistence spyware stealer

Malware Config

Signatures

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

Endermanch@InternetSecurityGuard.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest Endermanch@InternetSecurityGuard.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	Endermanch@InternetSecurityGuard.exe

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	Endermanch@InternetSecurityGuard.exe

Drops file in Drivers directory 4 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\etc\hosts	Endermanch@InternetSecurityGuard.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Endermanch@InternetSecurityGuard.exe
File created	C:\Windows\system32\drivers\etc\host_new	Endermanch@InternetSecurityGuard.exe
File created	C:\Windows\System32\drivers\etc\hosts	Endermanch@InternetSecurityGuard.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswRunDll.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\escanhnt.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcagent.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msbb.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\frmwrk32.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avwin.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgui.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gator.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcupdate.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\normist.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nt.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pfwadmin.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pingscan.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgwdsvc.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avsched32.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win32us.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wnad.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sysupd.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\atwatch.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\luall.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcsrvx.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bootconf.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msmgt.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nupgrade.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-98.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PSANHost.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vfsetup.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\onsrvr.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\srexe.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc42.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wupdt.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\belt.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dpf.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rapapp.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\aswChLic.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\au.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blackice.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ent.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mghtml.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvcl.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssurf.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\win-bugsfix.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winstart001.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\d.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cwnb181.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\blss.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\padmin.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procexplorerv1.0.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgcmgr.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PavFnSvr.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\efpeadm.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win_trial.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\intren.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\keenvalue.exe	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mgavrtcl.exe\Debugger = "svchost.exe"	Endermanch@InternetSecurityGuard.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description	ioc
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\7ec1c\\IS559.exe\" /s /d"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Windows\CurrentVersion\Run	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	Endermanch@InternetSecurityGuard.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	Endermanch@InternetSecurityGuard.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

Endermanch@InternetSecurityGuard.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ Endermanch@InternetSecurityGuard.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	Endermanch@InternetSecurityGuard.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
File opened (read-only)	\??\H:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\M:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\N:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\U:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\W:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\I:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\K:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\L:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\X:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\Y:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\E:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\J:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\P:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\V:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\Z:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\G:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\O:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\Q:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\R:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\S:	Endermanch@InternetSecurityGuard.exe
File opened (read-only)	\??\T:	Endermanch@InternetSecurityGuard.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

Endermanch@InternetSecurityGuard.exe

description ioc process

File opened for modification \??\PhysicalDrive0 Endermanch@InternetSecurityGuard.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
File opened for modification	\??\PhysicalDrive0	Endermanch@InternetSecurityGuard.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

T1112

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	Endermanch@InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\SearchScopes	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	Endermanch@InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0"	Endermanch@InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "23367"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	Endermanch@InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	Endermanch@InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0"	Endermanch@InternetSecurityGuard.exe

Modifies data under HKEY_USERS 6 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	Endermanch@InternetSecurityGuard.exe

Modifies registry class 15 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Endermanch@InternetSecurityGuard.exe"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Endermanch@InternetSecurityGuard.DocHostUIHandler	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Endermanch@InternetSecurityGuard.DocHostUIHandler\Clsid	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Endermanch@InternetSecurityGuard.DocHostUIHandler\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Endermanch@InternetSecurityGuard.DocHostUIHandler\ = "Implements DocHostUIHandler"	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "Endermanch@InternetSecurityGuard.DocHostUIHandler"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	Endermanch@InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software	Endermanch@InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	Endermanch@InternetSecurityGuard.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

pid	process
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe
3356	Endermanch@InternetSecurityGuard.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

mofcomp.exe

description pid process

Token: SeSecurityPrivilege 5064 mofcomp.exe
Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

pid process

3356 Endermanch@InternetSecurityGuard.exe
3356 Endermanch@InternetSecurityGuard.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

pid process

3356 Endermanch@InternetSecurityGuard.exe
3356 Endermanch@InternetSecurityGuard.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

pid process

3356 Endermanch@InternetSecurityGuard.exe
3356 Endermanch@InternetSecurityGuard.exe

description	pid	process
Token: SeSecurityPrivilege	5064	mofcomp.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

Endermanch@InternetSecurityGuard.exe

description	pid	process	target process
PID 3356 wrote to memory of 5064	3356	Endermanch@InternetSecurityGuard.exe	mofcomp.exe
PID 3356 wrote to memory of 5064	3356	Endermanch@InternetSecurityGuard.exe	mofcomp.exe
PID 3356 wrote to memory of 5064	3356	Endermanch@InternetSecurityGuard.exe	mofcomp.exe
PID 3356 wrote to memory of 3932	3356	Endermanch@InternetSecurityGuard.exe	netsh.exe
PID 3356 wrote to memory of 3932	3356	Endermanch@InternetSecurityGuard.exe	netsh.exe
PID 3356 wrote to memory of 3932	3356	Endermanch@InternetSecurityGuard.exe	netsh.exe
PID 3356 wrote to memory of 224	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 224	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 224	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4048	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4048	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4048	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1232	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1232	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1232	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4180	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4180	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4180	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3876	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3876	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3876	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3820	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3820	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3820	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3504	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3504	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3504	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 496	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 496	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 496	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4376	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4376	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4376	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4144	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4144	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4144	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1544	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1544	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1544	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1556	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1556	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1556	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1052	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1052	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1052	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1280	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1280	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 1280	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4412	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4412	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4412	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3952	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3952	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3952	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3660	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3660	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 3660	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4540	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4540	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4540	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4308	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4308	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4308	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe
PID 3356 wrote to memory of 4656	3356	Endermanch@InternetSecurityGuard.exe	nslookup.exe

C:\Users\Admin\AppData\Local\Temp\Endermanch@InternetSecurityGuard.exe
"C:\Users\Admin\AppData\Local\Temp\Endermanch@InternetSecurityGuard.exe"
1⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Sets file execution options in registry
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3356

C:\Windows\SysWOW64\Wbem\mofcomp.exe
mofcomp "C:\Users\Admin\AppData\Local\Temp\8463.mof"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5064

C:\Windows\SysWOW64\netsh.exe
netsh "firewall" add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Endermanch@InternetSecurityGuard.exe" "Internet Security Guard" ENABLE
2⤵
PID:3932

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.com 8.8.8.8
2⤵
PID:224

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.net 8.8.8.8
2⤵
PID:4048

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.com 208.67.222.222
2⤵
PID:1232

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.net 208.67.222.222
2⤵
PID:4180

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.com 8.8.4.4
2⤵
PID:3876

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.net 8.8.4.4
2⤵
PID:3820

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.com 208.67.220.220
2⤵
PID:3504

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt cjru459cdmsvzbd.net 208.67.220.220
2⤵
PID:496

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.com 8.8.8.8
2⤵
PID:4376

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.net 8.8.8.8
2⤵
PID:4144

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.com 208.67.222.222
2⤵
PID:1544

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.net 208.67.222.222
2⤵
PID:1556

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.com 8.8.4.4
2⤵
PID:1052

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.net 8.8.4.4
2⤵
PID:1280

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.com 208.67.220.220
2⤵
PID:4412

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt lmn187nwcjjmttcd.net 208.67.220.220
2⤵
PID:3952

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.com 8.8.8.8
2⤵
PID:3660

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.net 8.8.8.8
2⤵
PID:4540

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.com 208.67.222.222
2⤵
PID:4308

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.net 208.67.222.222
2⤵
PID:4656

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.com 8.8.4.4
2⤵
PID:4652

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.net 8.8.4.4
2⤵
PID:3104

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.com 208.67.220.220
2⤵
PID:1008

C:\Windows\SysWOW64\nslookup.exe
nslookup -q=txt jnuxfmopyej1598l.net 208.67.220.220
2⤵
PID:4380

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\7ec1c\IS559.exe
Filesize
6.1MB

MD5
04155ed507699b4e37532e8371192c0b

SHA1
a14107131237dbb0df750e74281c462a2ea61016

SHA256
b6371644b93b9d3b9b32b2f13f8265f9c23ddecc1e9c5a0291bbf98aa0fc3b77

SHA512
6de59ebbc9b96c8a19d530caa13aa8129531ebd14b3b6c6bbb758426b59ed5ab12483bfa232d853af2e661021231b4b3fcc6c53e187eeba38fa523f673115371

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
185B

MD5
b8224e5293d4fad1927c751cc00c80e7

SHA1
270b8c752c7e93ec5485361fe6ef7b37f0b4513b

SHA256
c47da9be4fc4d757add73c49654c9179067af547d0cc758d6356e2955bbfcb61

SHA512
8fed9a509e46319529145fa2159251e43040d26080af84e44badaab1dd339c767ff75a2c473bc0abfb448b03beb96718ee34ba6bc150ed3085322878b55a22f2

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
379B

MD5
e2abeecfc462961a4a507b07095ec128

SHA1
a5e069d7439e0680381619133e771b72dd9ec3fa

SHA256
5b62dff31e0421c4974bae36f760860c930b8312232cc6cf6281e1668cd6cbf5

SHA512
43ffefc750eef709843016f26334965f2426cff90409603c64e610c22e14df41e1fd4a72d9ecdba0f2e361ff185d86626f6ba7214ba438d32d3ef2ee392c003a

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
662B

MD5
e6222b141530045907ff8c0293096731

SHA1
377068be7f539a504911f224186ffcf8b05bfb97

SHA256
ae7b6f1be3b25858bd80aa1423d6dbef0a17b8339213f91c172fe8a2f52e7c2c

SHA512
0296c2c93a2852cfd21b75289be1b2b879bf9cd0e7dd463cb37c7c019ab6d2750a38f6ac0137da41b6522015cd4c68ffb21f649ce1195284840b5deb1ae071ab

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
1KB

MD5
c58fec632056a1a8ff6e18f87dde29ec

SHA1
393b0aaf3b9fbf1a8d886807d8f357efd99e58e7

SHA256
3e66e40aeb1dd21ae90ac9339f5cde66749eed39bc3f4ade30c3dda0aeedcae1

SHA512
b4259d68e4fe9b1dafeb98a4ed4dfd9e5deaed670a562dbc61adbad1cd763901f311b11fa68a18c7034386630f84ce4cc741feda6bb76d88786a45b96f3ce81e

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
1KB

MD5
6d88cb0b38e6ea85b8bacb19aeba96c0

SHA1
f65684b7eda74f5ffaea1dc8adc3acdb1a51b6c5

SHA256
7eb61bf791a04ccbb8f280d842f7f62bb9fd5536f1427efa73e38eb69727c829

SHA512
85266e3a9154f5e322c30781e50be60c87932ecf939d9b2a5e4415af9c94f32fb69170d9c06887be0fb6d62d6b09a1c7092df75557287b57153b3e546f983b00

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
1KB

MD5
4b5f2b96da86182f06d1aeebae59a2c3

SHA1
7ac97aeffed9178fc681c83835e5354a1f035e25

SHA256
90ec732c936607b8e10c7189abcb634fecc3de375b28997484240bdde7306edc

SHA512
33e6d37c241c48bc790ddc4f2b277c4cc87372387355710366ff1304870d5acefb43383f65d3cdaa95f8bda67daa8d0ba76dc2cee9f0de0530762fc56b9da47f

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
2KB

MD5
805ed3e5ecc4c3910cdac0f096282ebe

SHA1
5bdda77819d357534205c1db3217b57223fcbe67

SHA256
af36fdc2720b88afd40816207a026b2ff0e457122d8f92521c79ffaabad33eb7

SHA512
18a84885beea760cf2588ac29f53755c05fe8ecfd3df70fff127d31100e10dfe53afd7da9a2e3dbf66c1dfb3447b2120403aab02ed2c097a9a0bdd7290f60f5d

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
2KB

MD5
c894f63d7513dd284dcb85b787d097c4

SHA1
616807cd59ba5d8843fcbacf8ab6e4b1cacf162f

SHA256
ae2df0a3c3cfab4452f40dbbd9748cb9a484c21c77d2e4b1e7aac8854f496881

SHA512
fb67c4d9182300a4d1dc874899992223a1404c8d7234431cee8a6876c2d3b0962a828c0322d46c4f30b00188f40be924fe63ce66d8a434f96b153fcb7a15de7d

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
5KB

MD5
e678510999f7e6e335349f9479a64515

SHA1
242577a90786b871ba729b872fb2b197c494213f

SHA256
b04f8fab8ec18d0dfd0a44269bc3a79b2b808f91c934cc48393c823ab56d425c

SHA512
76dd68494dd62d0c51c83184a29336817f984430d99f3d7c4b1cbcdd03b32b1ced07aa7256cf42ce71dbf88adea34595c0624d0f0951a25b6d40eb4cd6d99541

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
5KB

MD5
e678510999f7e6e335349f9479a64515

SHA1
242577a90786b871ba729b872fb2b197c494213f

SHA256
b04f8fab8ec18d0dfd0a44269bc3a79b2b808f91c934cc48393c823ab56d425c

SHA512
76dd68494dd62d0c51c83184a29336817f984430d99f3d7c4b1cbcdd03b32b1ced07aa7256cf42ce71dbf88adea34595c0624d0f0951a25b6d40eb4cd6d99541

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
6KB

MD5
57284618e6d9017be36f6d956c5f71e5

SHA1
1ae74479039ed7b141e2ede8e6b1b333bb1d43ef

SHA256
000073c55447e37d7bc6fb687df65efa1c10d68866f65f9ab54a2ea8174d5e48

SHA512
dca94435662ef779cccfb1eee43ba252d857c12a44790d30e58d186c1ae0088fd4ac0674b324dd53ba2612621ea0a00347a4a5d2670f51490036a704ef4a135e

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
6KB

MD5
4dcfbf8633e5fa7daa5687b50de12cc0

SHA1
6d0a9b9308fefce5c826e26cddea212bafbf9a4d

SHA256
fe2b8177ab356824225375915607296cc61845859b58bdbea7eb1a91d17b1b77

SHA512
946da018aab5ef718025e273f1f1a35f463fd981f32a78805953878e719c309aa0bd1f67c4273d06a5a6eb13f7ed5d33a21bd814269ff51ad1f0025ce2f8b522

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
7KB

MD5
2c7fc7caea8db5e177c76969e0a97f9c

SHA1
fd68cde082b278027a75d6ecbb117c3a095973c6

SHA256
3441836e6d0a38625eb2d589308bfbfed53ca6822315a5b7dfa0664f77feb5a9

SHA512
408337eed476c8aa9b5b98df7710b716f55edb72d35bc957053da2ff22d591c3bb6af40391ee61dcf021641112c3b0160426e4edb5b5785ee4cf94177166e4e6

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
8KB

MD5
452d1d39d86a08872500beb19c6f4b43

SHA1
edb802fa8ada679d54e47b3315a44a37ee097c28

SHA256
3847b3c8a32e52aaa3225efeabe0e19eea8b4074f796a6a8bc50db888044dc3d

SHA512
44700bb782b145e67766b1134b5da34e2e2ca54fceff41e57ae4b992ac67d8328d9a5f1fc38d682ebed5e75ceea04786d8910750366ae71730e6d0ccd8047d5a

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
9KB

MD5
1b148338b6b27d900ed309d579745053

SHA1
b1bac33cf823ce4e484683e5414230ccb47eeb94

SHA256
1145274e81c66e4cc1bd7a78d913a06c11bbb17e41766fa2540d8b29f8dae6c5

SHA512
1adc8d28c78190a3e147cbccdf2dca54d2191eca2fe0b15ce76d8f2fb3c9924309a717c21bf59ac30b593d5611e81009b6b6326774685128bc4b59298084562d

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
11KB

MD5
46c89f8351a3992cba0ae2185eda775b

SHA1
f354d256b4144e0822245dcd637c0cf0ff97f305

SHA256
895111cbd93bb0371aee30e607ea613d9e239b5f65d6ee798768dfc0129f7f8d

SHA512
9f9bd015c43b445052c1eb9faabe9652da278b6689f61dae1add1fb4c7570c8eb6edb0e14393f31facdc13d76230581f8d8949a24bd44f1513423b20ee57e600

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
11KB

MD5
46c89f8351a3992cba0ae2185eda775b

SHA1
f354d256b4144e0822245dcd637c0cf0ff97f305

SHA256
895111cbd93bb0371aee30e607ea613d9e239b5f65d6ee798768dfc0129f7f8d

SHA512
9f9bd015c43b445052c1eb9faabe9652da278b6689f61dae1add1fb4c7570c8eb6edb0e14393f31facdc13d76230581f8d8949a24bd44f1513423b20ee57e600

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
13KB

MD5
17ed7af615553ecb9cfb40b0b64dbdfe

SHA1
23f478ed6ff78890b65128ea4588b3c6bdbf3868

SHA256
6208baa733a69317f17f909a5d7b993b1eeb82fbcfdf8e26373693e568d1f9e9

SHA512
fdc69b01d67985125ac627c0f7092109649ca97f5ca4b4c83956c37f2292adc81d955827501a814e73adc44d6ca07bb5d4e765e6976cf130ca2aec2cf59565b2

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
14KB

MD5
9189cbc8f580784c0244b982ea3c52f1

SHA1
f8b3814be859070458ebdb067c533a9e7ad51d9c

SHA256
bbcad377f92d6dbade8ad9f8edc76f7b82ff84141bb63ff0449558a80ab8c145

SHA512
bd3d822bed6f8edb30d5f651baee5e3f9ad06cbe04c5c4192f566281aebf38bc39b705db32c8a6cba58e3274131d9fd6dcef4cf5dfa308b12e7164099ca25ef0

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
15KB

MD5
1ff05229b9eb13b0c099d7bf78b68d82

SHA1
e9db60ff493fc138e6907e48884111a608f2f674

SHA256
a7e089470d47e8742530c3b599beb21ab71b7bec418989101b282e792a96175d

SHA512
53f8e0f8a841c59b97958c15ea79a06a32320067bd84b6391c7472be9d520685f8223b3a62189f42c2e78753c3a866b1c706a5b5b81ffd16fccc8872de873e87

Download Submit
C:\ProgramData\ISXKQMFG\ISEWWMAJQG.cfg
Filesize
16KB

MD5
56590800c83db05d002bd29bb8286b76

SHA1
20449e5219264544d840f62b73b8520322a8f275

SHA256
0a1362221796220eb97b9c65e57e9751da73dd83e5692385b02a9cb94018027b

SHA512
f88bd188cb6c32a42164209fb7962f9db650f80bcb6f831ebff6c1dece2d55e3fe2dd0257c9f6dd59d31d800f160246664e27cce5f688dd6c23b624209d19851

Download Submit
C:\Users\Admin\AppData\Local\Temp\8463.mof
Filesize
344B

MD5
3754f8f8abad5bad797085d0717a9766

SHA1
48d92f36cb721b390e216aa03b27b41f25c563fc

SHA256
3c77f5f888d417a7a31284cb8c5e3bdb4d926c4a274cecac8a8b2920659d5927

SHA512
c59f322ece53c757767e52fe9bfbc3526a13afe9ec7503e3d1cae683eeb55cbb808a1bce720fd58f97f286756d314124bcf797c2167275e08ed93ba759bf3985

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\suuk1m1w.default-release\prefs.js
Filesize
6KB

MD5
494fd39c6c3b65f63bd38507db6395c1

SHA1
b3b49acd8e21d49f400d36a4cf3bec06910fae17

SHA256
266d02f6a284375cce18085283dde546d2e8da53dc118539d26a9582b47c777f

SHA512
3293515b7adecf1e0713599ffc86a387113eec59bd4fac4f190fc7e4d80e0c81db875ccfd56d5201090c28746da478db9a90ecadd73ab4110b4f9e06e344e8a7

Download Submit
C:\Windows\System32\drivers\etc\hosts
Filesize
1KB

MD5
008fba141529811128b8cd5f52300f6e

SHA1
1a350b35d82cb4bd7a924b6840c36a678105f793

SHA256
ab0e454a786ef19a3ae1337f10f47354ffa9521ea5026e9e11174eca22d86e84

SHA512
80189560b6cf180a9c1ecafc90018b48541687f52f5d49b54ca25e040b3264da053e3d4dbb0cd38caaf496e23e516de18f500b333e3cda1fd1b25c6e9632defc

Download Submit
memory/3356-504-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3356-737-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-627-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-406-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-626-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-133-0x0000000000710000-0x0000000000711000-memory.dmp

Filesize
4KB

Download
memory/3356-625-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-574-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-740-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-743-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-744-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-745-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-746-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-747-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-748-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download
memory/3356-749-0x0000000013140000-0x0000000013764000-memory.dmp

Filesize
6.1MB

Download