Analysis
-
max time kernel
131s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 06:05
Behavioral task
behavioral1
Sample
588f06dad5090f1ebb6ac3ee23dc0e79.exe
Resource
win7-20231215-en
windows7-x64
27 signatures
150 seconds
Behavioral task
behavioral2
Sample
588f06dad5090f1ebb6ac3ee23dc0e79.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
28 signatures
150 seconds
General
-
Target
588f06dad5090f1ebb6ac3ee23dc0e79.exe
-
Size
667KB
-
MD5
588f06dad5090f1ebb6ac3ee23dc0e79
-
SHA1
a0f4f6d0c31e507dce0b1c7cd4759079f23f0308
-
SHA256
e02457960f362fc8630e22a19fd64d3c8a1ff04db1f85f5c3fcc39b9c4fc6acc
-
SHA512
2a77956109742c08dbe9246d3d6b9f49bd61bd7c0aa8ef07cfed745b3c75c506781ffb8f83bb39a598503a3b18b010e1980493f8be53eded7d7b3bd1faecc308
-
SSDEEP
12288:WbMqm0EEb4E9F/ATyGv4XKGQi2lJLm1Giizl6oAlpxElrW1A:WIKEEb4Ev/ATEXKGVnGTzpA1Ec1A
Malware Config
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "3" bohost.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" DV245F.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" rmjiic.exe -
ModiLoader Second Stage 9 IoCs
resource yara_rule behavioral2/memory/2324-0-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/2324-5-0x0000000000400000-0x000000000041F000-memory.dmp modiloader_stage2 behavioral2/memory/3476-7-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral2/memory/3476-9-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral2/memory/3476-36-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral2/files/0x0006000000023237-38.dat modiloader_stage2 behavioral2/memory/2308-49-0x0000000000400000-0x000000000041E000-memory.dmp modiloader_stage2 behavioral2/memory/3476-207-0x0000000000400000-0x00000000004CF000-memory.dmp modiloader_stage2 behavioral2/memory/764-213-0x00000000006F0000-0x00000000007F0000-memory.dmp modiloader_stage2 -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation DV245F.exe Key value queried \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Control Panel\International\Geo\Nation 588f06dad5090f1ebb6ac3ee23dc0e79.exe -
Executes dropped EXE 8 IoCs
pid Process 1776 DV245F.exe 2308 aohost.exe 4012 rmjiic.exe 1036 aohost.exe 3900 bohost.exe 3216 dohost.exe 1292 bohost.exe 764 bohost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/memory/3476-1-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-2-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-6-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-7-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-9-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-8-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/3476-36-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/1036-44-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-45-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-55-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-59-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-57-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/1036-61-0x0000000000400000-0x0000000000427000-memory.dmp upx behavioral2/memory/3900-62-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-64-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-70-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-83-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-129-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/1292-132-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/1292-135-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-137-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3476-207-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral2/memory/764-214-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-258-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral2/memory/3900-388-0x0000000000400000-0x0000000000452000-memory.dmp upx -
Adds Run key to start application 2 TTPs 52 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /I" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /z" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /x" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /A" rmjiic.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\B0B.exe = "C:\\Program Files (x86)\\LP\\028E\\B0B.exe" bohost.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /W" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /R" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /X" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /l" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /q" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /p" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /u" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /h" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /D" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /N" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /P" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /O" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /e" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /C" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /g" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /U" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /y" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /w" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /s" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /Y" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /T" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /H" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /v" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /Z" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /t" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /K" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /J" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /b" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /L" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /a" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /Q" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /S" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /i" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /o" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /M" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /B" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /Y" DV245F.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /V" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /G" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /c" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /m" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /E" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /r" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /d" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /F" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /f" rmjiic.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rmjiic = "C:\\Users\\Admin\\rmjiic.exe /n" rmjiic.exe -
Enumerates connected drives 3 TTPs 8 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum aohost.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 aohost.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2324 set thread context of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2308 set thread context of 1036 2308 aohost.exe 106 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\028E\B0B.exe bohost.exe File opened for modification C:\Program Files (x86)\LP\028E\DDD8.tmp bohost.exe File opened for modification C:\Program Files (x86)\LP\028E\B0B.exe bohost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 1576 tasklist.exe 4100 tasklist.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\Software\Microsoft\Internet Explorer\GPU Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Internet Explorer\GPU Process not Found -
Modifies registry class 63 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.search Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "56" Process not Found Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-996941297-2279405024-2328152752-1000\{84705349-D57E-4BC3-A39C-55D9EBC80F19} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.search Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" Process not Found Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "56" Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-996941297-2279405024-2328152752-1000\{CC8BE6F6-C4FF-4F5B-A732-AE1B51AE9E32} explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-996941297-2279405024-2328152752-1000\{34A353A3-30AB-4F69-B084-81349C153889} explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total Process not Found Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-996941297-2279405024-2328152752-1000\{773938A7-D71D-4A49-BBDC-DC2F9A5C1848} explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\Recognizers\\Tokens\\MS-1033-110-WINMO-DNN" Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search\Total = "23" Process not Found Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total Process not Found Key created \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1776 DV245F.exe 1776 DV245F.exe 1776 DV245F.exe 1776 DV245F.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 1036 aohost.exe 1036 aohost.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe 4012 rmjiic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1576 tasklist.exe Token: SeSecurityPrivilege 1500 msiexec.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeDebugPrivilege 4100 tasklist.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 2648 explorer.exe Token: SeCreatePagefilePrivilege 2648 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 4296 explorer.exe Token: SeCreatePagefilePrivilege 4296 explorer.exe Token: SeShutdownPrivilege 2188 explorer.exe Token: SeCreatePagefilePrivilege 2188 explorer.exe Token: SeShutdownPrivilege 2188 explorer.exe Token: SeCreatePagefilePrivilege 2188 explorer.exe Token: SeShutdownPrivilege 2188 explorer.exe Token: SeCreatePagefilePrivilege 2188 explorer.exe Token: SeShutdownPrivilege 2188 explorer.exe Token: SeCreatePagefilePrivilege 2188 explorer.exe Token: SeShutdownPrivilege 2188 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe -
Suspicious use of SendNotifyMessage 55 IoCs
pid Process 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 2648 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 4296 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 2188 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe 5500 explorer.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 1776 DV245F.exe 4012 rmjiic.exe 3216 dohost.exe 3972 StartMenuExperienceHost.exe 3504 StartMenuExperienceHost.exe 4896 StartMenuExperienceHost.exe 2148 Process not Found -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 2324 wrote to memory of 3476 2324 588f06dad5090f1ebb6ac3ee23dc0e79.exe 93 PID 3476 wrote to memory of 1776 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 96 PID 3476 wrote to memory of 1776 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 96 PID 3476 wrote to memory of 1776 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 96 PID 3476 wrote to memory of 2308 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 100 PID 3476 wrote to memory of 2308 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 100 PID 3476 wrote to memory of 2308 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 100 PID 1776 wrote to memory of 4012 1776 DV245F.exe 103 PID 1776 wrote to memory of 4012 1776 DV245F.exe 103 PID 1776 wrote to memory of 4012 1776 DV245F.exe 103 PID 1776 wrote to memory of 1972 1776 DV245F.exe 101 PID 1776 wrote to memory of 1972 1776 DV245F.exe 101 PID 1776 wrote to memory of 1972 1776 DV245F.exe 101 PID 1972 wrote to memory of 1576 1972 cmd.exe 104 PID 1972 wrote to memory of 1576 1972 cmd.exe 104 PID 1972 wrote to memory of 1576 1972 cmd.exe 104 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 2308 wrote to memory of 1036 2308 aohost.exe 106 PID 3476 wrote to memory of 3900 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 107 PID 3476 wrote to memory of 3900 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 107 PID 3476 wrote to memory of 3900 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 107 PID 3476 wrote to memory of 3216 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 111 PID 3476 wrote to memory of 3216 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 111 PID 3476 wrote to memory of 3216 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 111 PID 3900 wrote to memory of 1292 3900 bohost.exe 116 PID 3900 wrote to memory of 1292 3900 bohost.exe 116 PID 3900 wrote to memory of 1292 3900 bohost.exe 116 PID 3476 wrote to memory of 3084 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 118 PID 3476 wrote to memory of 3084 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 118 PID 3476 wrote to memory of 3084 3476 588f06dad5090f1ebb6ac3ee23dc0e79.exe 118 PID 3900 wrote to memory of 764 3900 bohost.exe 120 PID 3900 wrote to memory of 764 3900 bohost.exe 120 PID 3900 wrote to memory of 764 3900 bohost.exe 120 PID 3084 wrote to memory of 4100 3084 cmd.exe 121 PID 3084 wrote to memory of 4100 3084 cmd.exe 121 PID 3084 wrote to memory of 4100 3084 cmd.exe 121 PID 4012 wrote to memory of 4100 4012 rmjiic.exe 121 PID 4012 wrote to memory of 4100 4012 rmjiic.exe 121 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer bohost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" bohost.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\588f06dad5090f1ebb6ac3ee23dc0e79.exe"C:\Users\Admin\AppData\Local\Temp\588f06dad5090f1ebb6ac3ee23dc0e79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\588f06dad5090f1ebb6ac3ee23dc0e79.exe588f06dad5090f1ebb6ac3ee23dc0e79.exe2⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Users\Admin\DV245F.exeC:\Users\Admin\DV245F.exe3⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1776 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del DV245F.exe4⤵
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Windows\SysWOW64\tasklist.exetasklist5⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
-
C:\Users\Admin\rmjiic.exe"C:\Users\Admin\rmjiic.exe"4⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4012
-
-
-
C:\Users\Admin\aohost.exeC:\Users\Admin\aohost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Users\Admin\aohost.exeaohost.exe4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
PID:1036
-
-
-
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe3⤵
- Modifies security service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3900 -
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe startC:\Users\Admin\AppData\Roaming\E8A28\0A102.exe%C:\Users\Admin\AppData\Roaming\E8A284⤵
- Executes dropped EXE
PID:1292
-
-
C:\Users\Admin\bohost.exeC:\Users\Admin\bohost.exe startC:\Program Files (x86)\28B61\lvvm.exe%C:\Program Files (x86)\28B614⤵
- Executes dropped EXE
PID:764
-
-
-
C:\Users\Admin\dohost.exeC:\Users\Admin\dohost.exe3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3216
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 588f06dad5090f1ebb6ac3ee23dc0e79.exe3⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Windows\SysWOW64\tasklist.exetasklist4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4100
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1500
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2648
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
PID:2148
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3972
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4296
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3504
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2188
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4896
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Enumerates connected drives
- Modifies registry class
- Suspicious use of SendNotifyMessage
PID:5500
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:5836
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:5976
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize471B
MD577c1ba2daffd207f06a16bd9a535e6a8
SHA18dcd37000e07fba29fafbac3a1d2041e4f62715d
SHA25665f49c86a4f270f2ba3d9216d96d3b0097d7d695e86b8b35f95cf3fedcb605c2
SHA512731092dd2f255c60f18a1b33bf1d25f0bc954949d6920becc3754554ecfb1f48975989ecae3b1b879e8110044d3d3889d91cd35b3384d9eccacac18e5083fe7b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_D46D6FA25B74360E1349F9015B5CCE53
Filesize412B
MD5cad6a9acc007a1c3462b44fa261777c5
SHA17503615eeb7a51663c7eafca744d5d34d5c361c5
SHA256feb140c30eb52a114c23683f93cf10e3a303835619ec88acff813b05bb41965e
SHA5121166dad76d7192f066332ee7ef65d26a1567274c11a46f01d5228b23e666332cbb6d8d5a6aab4dd805ff515072eae0b304d24f078852d5d7fd2307a7fed3b82a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133481450948901032.txt
Filesize74KB
MD5c09e63e4b960a163934b3c29f3bd2cc9
SHA1d3a43b35c14ae2e353a1a15c518ab2595f6a0399
SHA256308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157
SHA5125ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7DHDOXKH\microsoft.windows[1].xml
Filesize97B
MD5987bb3df0e0fc1835627eb2426f19455
SHA17b7826ad5baebd97b47a9ee5db84dbbda2a109b0
SHA256688690f17735e8b54fbb0703e36adc47df825037d38d1e9f7b676a4d3dbf1fa9
SHA512430b2dda600c24137f63289115a774923e8d54080f624d890b8df726cb7d1ccbc2cc0b1885b28f24ffede82402973e7984236e5ae466ceaf42aa05a534c0f72c
-
Filesize
597B
MD55d6a7f16107274a2706aa0ff622115cf
SHA1d43403c539633c7914da19c3a80a1fffa25b8d90
SHA25693a9e9f7be7639060110e8d3df0a1b0b6c717118bb87483039bbc37fabc0bcfc
SHA512c4f3ee2eaa25fa38c2ad658cc2851b263f6d32de31e5590b27c8cdbb7d241d37949fd624dcbac138c045e87021b375b9594bdbb4c05c797d04dac83570038c8b
-
Filesize
1KB
MD579821d42a93c6b5cefe9b2bcc5019e2f
SHA18bad779272a3fad8dfe9ba20205c21c4f5ad1f60
SHA2568cb048cb77a977c5b7bdd164f82d85d4fd29662b0feaf504df42329308d46abe
SHA512674fb89445675343cc28243d2d66506f8e04393e16c4c7bf5e95be2625ff107d6a45114b77bd227a59e881d6e8f253a8e09e4f0a7a0db501bd3d7d1dff8a5283
-
Filesize
1KB
MD5e8dda6f376d53bbb63e29ac2e6f6d249
SHA19a523fb45f805beea2193ff11fe86c1f6bc5f8b4
SHA256a9648f0e86ac0322137a1172180675e1f1319f79e6b71b91425efec594b71226
SHA512810b11bfb244d1921f0561a08a50eccdcc49269adab0c2d440bd00950d356cbe802c29955032bbe463cfa0f3f05dbcd464271f2232c58f47c36568b1635340f4
-
Filesize
297B
MD5781421343b44d32137ee7356d9c32dbc
SHA1469e454633a6e557e9f83c35eadf907c5c2b0cfc
SHA2561df5a13feb5fd8fcfec60948a09ae1a9a195f76d259a6039fc2183550b488587
SHA51291afc299409c50379453e02cf3768587b9b62b8728b176073c88a3fed385ae6a8253a731c76414ceb31d1c1403e75df443f2adbac00927c43c327d683e943273
-
Filesize
216KB
MD500b1af88e176b5fdb1b82a38cfdce35b
SHA1c0f77262df92698911e0ac2f7774e93fc6b06280
SHA25650f026d57fea9c00d49629484442ea59cccc0053d7db73168d68544a3bbf6f59
SHA5129e55e7c440af901f9c6d0cdae619f6e964b9b75c9351c76ea64362ff161c150b12a1caabb3d2eb63353a59ae70e7159ca6b3793ed0cc11994766846ac316107f
-
Filesize
152KB
MD54401958b004eb197d4f0c0aaccee9a18
SHA150e600f7c5c918145c5a270b472b114faa72a971
SHA2564c477ed134bc76fa7b912f1aad5e59d4f56f993baa16646e25fec2fdeed3bd8b
SHA512f0548bdaafce2cde2f9d3bd1c26ed3c8e9321ef6d706bd372e18886d834828e5bb54ae44f19764e94574ceb4a1a2a99bdd8476e174b05114fcac9a6d4a2d58e6
-
Filesize
173KB
MD50578a41258df62b7b4320ceaafedde53
SHA150e7c0b00f8f1e5355423893f10ae8ee844d70f4
SHA25618941e3030ef70437a5330e4689ec262f887f6f6f1da1cd66c0cbae2a76e75bf
SHA5125870a73798bad1f92b4d79f20bf618112ec8917574f6b25ab968c47afff419a829eef57b0282fb4c53e6e636436c8cf52a01426c46bdd4a0ea948d371f0feb09
-
Filesize
24KB
MD5d7390e209a42ea46d9cbfc5177b8324e
SHA1eff57330de49be19d2514dd08e614afc97b061d2
SHA256d2d49c37bdf2313756897245c3050494b39e824af448450eca1c0e83cf95b1e5
SHA512de0eb11dd20cd9d74f47b138fb4189a299a57173fe2635150045b01629354f35b26e0575acd25501403af0db238a123b2e5a79582b47aee1d6e786f5eec1929d
-
Filesize
216KB
MD53a301c2efb8517ae3e638d9aaefe821b
SHA1798da4785563252f10306380ec9c9146dd97448d
SHA256ee0d59ea006f9da86a8d6f5b5f634bd3838a4d8105cf0918a3187a55d97f292e
SHA51228f79100c4743d4e91224ec03842c177111afe0a5f39d678745c1236014e86f1b3c9f8d20af3cae865caeb115b8e8bdfd70e7104a8503b698c25a90daada29b9