60298bdfe71a400ccbad7019ecbf567f42cff4e55fd43e37ba3ce884c889a290

Modify Registry

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0da582b7d6cdf20189b6691fbf97baeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe"	0da582b7d6cdf20189b6691fbf97baeb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run	0da582b7d6cdf20189b6691fbf97baeb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe"	0da582b7d6cdf20189b6691fbf97baeb.exe

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{X8RA541Q-6OQ3-7J22-I40G-42J2IP81RXX5}\StubPath = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe Restart"	0da582b7d6cdf20189b6691fbf97baeb.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{X8RA541Q-6OQ3-7J22-I40G-42J2IP81RXX5}	0da582b7d6cdf20189b6691fbf97baeb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Avgnt = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe"	0da582b7d6cdf20189b6691fbf97baeb.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\Avirnt = "c:\\directory\\Microsoft\\Pluguin\\Microsoft\\Pluguin.exe"	0da582b7d6cdf20189b6691fbf97baeb.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

pid process

2232 0da582b7d6cdf20189b6691fbf97baeb.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

pid process

2232 0da582b7d6cdf20189b6691fbf97baeb.exe

pid	process
2232	0da582b7d6cdf20189b6691fbf97baeb.exe

pid	process
2232	0da582b7d6cdf20189b6691fbf97baeb.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0da582b7d6cdf20189b6691fbf97baeb.exe

description	pid	process	target process
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE
PID 2232 wrote to memory of 1276	2232	0da582b7d6cdf20189b6691fbf97baeb.exe	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1276

C:\Users\Admin\AppData\Local\Temp\0da582b7d6cdf20189b6691fbf97baeb.exe
"C:\Users\Admin\AppData\Local\Temp\0da582b7d6cdf20189b6691fbf97baeb.exe"
2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2232

C:\Windows\SysWOW64\explorer.exe
explorer.exe
3⤵
PID:2116

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry