Analysis
- max time kernel
162s - max time network
176s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
07/01/2024, 20:02
General
- Target 455a6a7f15ba86a0fe02ae1d8beff7a3dc8e858380244a45141054b0d330135c.exe
- Size 12.1MB
- Sample240107-yr68cadcdj
- SHA256 455a6a7f15ba86a0fe02ae1d8beff7a3dc8e858380244a45141054b0d330135c
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Signatures
- BetaBot
Beta Bot is a Trojan that infects computers and disables Antivirus.
- Detect ZGRat V1 3 IoCs
- Modifies firewall policy service 2 TTPs 24 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- UAC bypass 3 TTPs 1 IoCs
- Windows security bypass 2 TTPs 2 IoCs
- ZGRat
ZGRat is remote access trojan written in C#.
- Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Looks for VMWare services registry key. 1 TTPs 5 IoCs
- Sets file execution options in registry 2 TTPs 14 IoCs
- Checks BIOS information in registry 2 TTPs 6 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
- Drops startup file 7 IoCs
- Executes dropped EXE 25 IoCs
- Loads dropped DLL 13 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Windows security modification 2 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 13 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 13 IoCs
- Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Maps connected drives based on registry 3 TTPs 10 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Program Files directory 13 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 8 IoCs
- NSIS installer 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 26 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 12 IoCs
- Modifies Internet Explorer Protected Mode 1 TTPs 24 IoCs
- Modifies Internet Explorer Protected Mode Banner 1 TTPs 6 IoCs
- Modifies Internet Explorer settings 1 TTPs 6 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 27 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- System policy modification 1 TTPs 1 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\455a6a7f15ba86a0fe02ae1d8beff7a3dc8e858380244a45141054b0d330135c.exe"C:\Users\Admin\AppData\Local\Temp\455a6a7f15ba86a0fe02ae1d8beff7a3dc8e858380244a45141054b0d330135c.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\455a6a7f15ba86a0fe02ae1d8beff7a3dc8e858380244a45141054b0d330135c.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Looks for VMWare services registry key.
- Drops startup file
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\eLefQgMaUJ4NQ84KxGKVrPJE.exe"C:\Users\Admin\Pictures\eLefQgMaUJ4NQ84KxGKVrPJE.exe"3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\Pictures\tIO4Y8V6C4vDtU8Ni7Lr2fES.exe"C:\Users\Admin\Pictures\tIO4Y8V6C4vDtU8Ni7Lr2fES.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BroomSetup.exeC:\Users\Admin\AppData\Local\Temp\BroomSetup.exe4⤵
- Looks for VMWare services registry key.
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\AppData\Local\Temp\nslAC3C.tmpC:\Users\Admin\AppData\Local\Temp\nslAC3C.tmp4⤵
- Looks for VMWare services registry key.
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\ProgramData\Java Updater\135yk9ym73i5.exe/prstb5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 6044 -s 11407⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\135yk9ym73i5.exe/prstb5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5772 -s 10767⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\135yk9ym73i5.exe/prstb5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2608 -s 11447⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\135yk9ym73i5.exe/prstb5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5148 -s 11327⤵
- Program crash
-
-
-
-
C:\ProgramData\Java Updater\135yk9ym73i5.exe/prstb5⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe6⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5864 -s 11407⤵
- Program crash
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4832 -s 11924⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5628 -s 6565⤵
- Program crash
-
-
-
-
C:\Users\Admin\Pictures\aooXgkpd3gyRzy2VWKMCiQFW.exe"C:\Users\Admin\Pictures\aooXgkpd3gyRzy2VWKMCiQFW.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KV75E.tmp\aooXgkpd3gyRzy2VWKMCiQFW.tmp"C:\Users\Admin\AppData\Local\Temp\is-KV75E.tmp\aooXgkpd3gyRzy2VWKMCiQFW.tmp" /SL5="$700E8,140559,56832,C:\Users\Admin\Pictures\aooXgkpd3gyRzy2VWKMCiQFW.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-TEVNK.tmp\444567.exe"C:\Users\Admin\AppData\Local\Temp\is-TEVNK.tmp\444567.exe" /S /UID=lylal2205⤵
- Drops file in Drivers directory
- Looks for VMWare services registry key.
- Checks computer location settings
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5f-19d04-444-5119b-f447d1525fd04\Kixyzhikidu.exe"C:\Users\Admin\AppData\Local\Temp\5f-19d04-444-5119b-f447d1525fd04\Kixyzhikidu.exe"6⤵
- Looks for VMWare services registry key.
- Executes dropped EXE
- Checks whether UAC is enabled
- Maps connected drives based on registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files (x86)\Windows Photo Viewer\EMCIFAYLOZ\lightcleaner.exe"C:\Program Files (x86)\Windows Photo Viewer\EMCIFAYLOZ\lightcleaner.exe" /VERYSILENT6⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\is-OJBSA.tmp\lightcleaner.tmp"C:\Users\Admin\AppData\Local\Temp\is-OJBSA.tmp\lightcleaner.tmp" /SL5="$202AE,833775,56832,C:\Program Files (x86)\Windows Photo Viewer\EMCIFAYLOZ\lightcleaner.exe" /VERYSILENT7⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
-
-
-
-
-
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe"C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe" --silent --allusers=03⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exeC:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.28 --initial-client-data=0x2f0,0x2f4,0x2f8,0x2cc,0x2fc,0x6dd79530,0x6dd7953c,0x6dd795484⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe"C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" --exception-pointers=711574288 --process=600 /prefetch:7 --thread=60285⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
-
-
-
C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\bvRvuLyUXP4ypm0nhLGwBT0y.exe"C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\bvRvuLyUXP4ypm0nhLGwBT0y.exe" --version4⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe"C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe" --backend --install --import-browser-data=0 --enable-stats=1 --enable-installer-stats=1 --consent-given=0 --general-interests=0 --general-location=0 --personalized-content=0 --personalized-ads=0 --launchopera=1 --installfolder="C:\Users\Admin\AppData\Local\Programs\Opera" --profile-folder --language=en --singleprofile=0 --copyonly=0 --allusers=0 --setdefaultbrowser=1 --pintotaskbar=1 --pintostartmenu=1 --run-at-startup=1 --show-intro-overlay --server-tracking-data=server_tracking_data --initial-pid=1572 --package-dir-prefix="C:\Users\Admin\AppData\Local\Temp\.opera\Opera Installer Temp\opera_package_20240107200341" --session-guid=c24534b2-face-44f3-80db-c832be658e8d --server-tracking-blob=NDgwN2IwMDA0NTg3NWJiODI2OTZjMTEzOTEzOGM4NjYwMTI3MmIzM2FjZGNjNDhmZTkxMjE1M2QyMjNmOTBjMzp7ImNvdW50cnkiOiJHQiIsImluc3RhbGxlcl9uYW1lIjoiT3BlcmFTZXR1cC5leGUiLCJwcm9kdWN0Ijp7Im5hbWUiOiJvcGVyYSJ9LCJxdWVyeSI6Ii9vcGVyYS9zdGFibGUvd2luZG93cy8/dXRtX21lZGl1bT1hcGImdXRtX3NvdXJjZT1ta3QmdXRtX2NhbXBhaWduPTc2NyIsInN5c3RlbSI6eyJwbGF0Zm9ybSI6eyJhcmNoIjoieDg2XzY0Iiwib3BzeXMiOiJXaW5kb3dzIiwib3BzeXMtdmVyc2lvbiI6IjEwIiwicGFja2FnZSI6IkVYRSJ9fSwidGltZXN0YW1wIjoiMTcwNDY1Nzc5NC44NTUzIiwidXRtIjp7ImNhbXBhaWduIjoiNzY3IiwibWVkaXVtIjoiYXBiIiwic291cmNlIjoibWt0In0sInV1aWQiOiJjNGMzZDVhMy1lYzhhLTQ0ZDEtOWQwZi1iNjA3ODQ0NWQwMGEifQ== --silent --desktopshortcut=1 --wait-for-package --initial-proc-handle=54050000000000004⤵
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exeC:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" "--crash-count-file=C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\crash_count.txt" --url=https://crashstats-collector.opera.com/collector/submit --annotation=channel=Stable --annotation=plat=Win32 --annotation=prod=OperaDesktop --annotation=ver=106.0.4998.28 --initial-client-data=0x2e4,0x2e8,0x2ec,0x2c0,0x2fc,0x6d309530,0x6d30953c,0x6d3095485⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe"C:\Users\Admin\Pictures\bvRvuLyUXP4ypm0nhLGwBT0y.exe" --type=fallback-handler --database="C:\Users\Admin\AppData\Roaming\Opera Software\Opera Stable\Crash Reports" --exception-pointers=1103741712 --process=600 /prefetch:7 --thread=60206⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A5B1.exeC:\Users\Admin\AppData\Local\Temp\A5B1.exe1⤵
- Sets file execution options in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 10763⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\B2D1.exeC:\Users\Admin\AppData\Local\Temp\B2D1.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WindowsUpdater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4152 -ip 41521⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 6044 -ip 60441⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4832 -ip 48321⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5628 -ip 56281⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5772 -ip 57721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2608 -ip 26081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 5148 -ip 51481⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5864 -ip 58641⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
11Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
lightcleaner.exe
LightCleaner.lnk
opera_package
Kixyzhikidu.exe
A5B1.exe
B2D1.exe
B2D1.exe
BroomSetup.exe
Opera_installer_2401072003406061572.dll
Opera_installer_2401072003409811824.dll
Opera_installer_2401072003414812580.dll
WindowsUpdater.exe
__PSScriptPolicyTest_gbymmqtr.551.ps1
_shfoldr.dll
aooXgkpd3gyRzy2VWKMCiQFW.tmp
lightcleaner.tmp
444567.exe
444567.exe
idp.dll
lib.dll
INetC.dll
System.dll
nslAC3C.tmp
metadata
metadata
32ff72ec-0158-4cc1-943f-29b78423f6b5.dmp
48ea169f-f205-48a0-9491-dd30c69fa2b1.dmp
settings.dat
2vMZSPlriCXApXzrlemVoqY2.exe
Ad2x0swbkQczEua32tfIeUOY.exe
aooXgkpd3gyRzy2VWKMCiQFW.exe
bvRvuLyUXP4ypm0nhLGwBT0y.exe
bvRvuLyUXP4ypm0nhLGwBT0y.exe
bvRvuLyUXP4ypm0nhLGwBT0y.exe
bvRvuLyUXP4ypm0nhLGwBT0y.exe
debug.log
eLefQgMaUJ4NQ84KxGKVrPJE.exe
tIO4Y8V6C4vDtU8Ni7Lr2fES.exe
memory/1452-656-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1452-672-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1452-909-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/1452-904-0x00000000045B0000-0x0000000004674000-memory.dmp
memory/1452-817-0x00000000045B0000-0x0000000004674000-memory.dmp
memory/1572-828-0x00000000045A0000-0x0000000004664000-memory.dmp
memory/1808-856-0x000000000A010000-0x000000000A0D4000-memory.dmp
memory/1808-826-0x000000000A010000-0x000000000A0D4000-memory.dmp
memory/1808-835-0x000000000A010000-0x000000000A0D4000-memory.dmp
memory/1824-831-0x0000000003720000-0x00000000037E4000-memory.dmp
memory/2248-819-0x00000000046E0000-0x00000000047A4000-memory.dmp
memory/2248-657-0x0000000000400000-0x0000000000965000-memory.dmp
memory/2248-892-0x00000000046E0000-0x00000000047A4000-memory.dmp
memory/2248-887-0x00000000046E0000-0x00000000047A4000-memory.dmp
memory/2248-797-0x0000000000400000-0x0000000000965000-memory.dmp
memory/2580-839-0x0000000003690000-0x0000000003754000-memory.dmp
memory/2768-37-0x0000000006B70000-0x0000000006C92000-memory.dmp
memory/2768-9-0x00000000062D0000-0x00000000062DA000-memory.dmp
memory/2768-31-0x0000000006750000-0x00000000068AA000-memory.dmp
memory/2768-26-0x00000000066C0000-0x00000000066D2000-memory.dmp
memory/2768-25-0x0000000006330000-0x0000000006342000-memory.dmp
memory/2768-22-0x00000000066C0000-0x00000000066FB000-memory.dmp
memory/2768-16-0x00000000062D0000-0x00000000062DD000-memory.dmp
memory/2768-15-0x00000000066A0000-0x00000000066C0000-memory.dmp
memory/2768-14-0x00000000066A0000-0x0000000006729000-memory.dmp
memory/2768-13-0x00000000066A0000-0x00000000066D8000-memory.dmp
memory/2768-1-0x0000000000D20000-0x0000000001944000-memory.dmp
memory/2768-28-0x0000000006700000-0x0000000006710000-memory.dmp
memory/2768-45-0x00000000067F0000-0x0000000006820000-memory.dmp
memory/2768-46-0x0000000006BF0000-0x0000000006CAA000-memory.dmp
memory/2768-48-0x0000000006960000-0x00000000069C0000-memory.dmp
memory/2768-59-0x0000000006970000-0x0000000006978000-memory.dmp
memory/2768-60-0x0000000006990000-0x0000000006998000-memory.dmp
memory/2768-2-0x0000000006350000-0x00000000063EC000-memory.dmp
memory/2768-61-0x0000000006970000-0x000000000697E000-memory.dmp
memory/2768-62-0x00000000069C0000-0x00000000069CE000-memory.dmp
memory/2768-63-0x0000000006970000-0x0000000006978000-memory.dmp
memory/2768-58-0x0000000006C50000-0x0000000006CEC000-memory.dmp
memory/2768-40-0x0000000006830000-0x0000000006874000-memory.dmp
memory/2768-3-0x00000000062C0000-0x00000000062CA000-memory.dmp
memory/2768-8-0x00000000062D0000-0x00000000062D7000-memory.dmp
memory/2768-57-0x0000000006FC0000-0x000000000703C000-memory.dmp
memory/2768-33-0x0000000006750000-0x00000000067F4000-memory.dmp
memory/2768-56-0x0000000006C50000-0x0000000006CCC000-memory.dmp
memory/2768-55-0x00000000069A0000-0x00000000069BE000-memory.dmp
memory/2768-54-0x0000000006960000-0x000000000697E000-memory.dmp
memory/2768-36-0x0000000006770000-0x000000000678A000-memory.dmp
memory/2768-53-0x0000000007290000-0x0000000007554000-memory.dmp
memory/2768-41-0x0000000006790000-0x0000000006806000-memory.dmp
memory/2768-4-0x00000000062E0000-0x00000000062EA000-memory.dmp
memory/2768-35-0x0000000006710000-0x000000000672A000-memory.dmp
memory/2768-12-0x0000000006330000-0x000000000634F000-memory.dmp
memory/2768-17-0x0000000006330000-0x0000000006348000-memory.dmp
memory/2768-49-0x0000000006BF0000-0x0000000006C50000-memory.dmp
memory/2768-50-0x00000000067A0000-0x00000000067C0000-memory.dmp
memory/2768-51-0x00000000067D0000-0x00000000067F0000-memory.dmp
memory/2768-47-0x0000000006F00000-0x0000000006FBA000-memory.dmp
memory/2768-43-0x0000000006720000-0x0000000006730000-memory.dmp
memory/2768-39-0x0000000006790000-0x00000000067D4000-memory.dmp
memory/2768-42-0x0000000006B70000-0x0000000006BE6000-memory.dmp
memory/2768-32-0x0000000006A10000-0x0000000006B6A000-memory.dmp
memory/2768-52-0x0000000006FC0000-0x0000000007284000-memory.dmp
memory/2768-44-0x0000000006790000-0x00000000067C0000-memory.dmp
memory/2768-29-0x0000000006330000-0x0000000006348000-memory.dmp
memory/2768-30-0x0000000006730000-0x0000000006748000-memory.dmp
memory/2768-10-0x00000000062F0000-0x0000000006304000-memory.dmp
memory/2768-34-0x00000000068B0000-0x0000000006954000-memory.dmp
memory/2768-27-0x0000000006330000-0x0000000006340000-memory.dmp
memory/2768-11-0x00000000065A0000-0x0000000006D50000-memory.dmp
memory/2768-7-0x00000000062D0000-0x00000000062DA000-memory.dmp
memory/2768-24-0x0000000006330000-0x000000000634C000-memory.dmp
memory/2768-0-0x0000000074A50000-0x0000000075200000-memory.dmp
memory/2768-23-0x0000000006330000-0x0000000006343000-memory.dmp
memory/2768-19-0x00000000066C0000-0x00000000066ED000-memory.dmp
memory/2768-21-0x00000000066C0000-0x0000000006783000-memory.dmp
memory/2768-18-0x00000000066A0000-0x00000000066B8000-memory.dmp
memory/2768-6-0x00000000062F0000-0x0000000006316000-memory.dmp
memory/2768-38-0x0000000006DD0000-0x0000000006EF2000-memory.dmp
memory/2768-5-0x00000000062F0000-0x000000000631D000-memory.dmp
memory/2768-20-0x00000000066C0000-0x00000000067C5000-memory.dmp
memory/2908-702-0x00000000021C0000-0x0000000002226000-memory.dmp
memory/2908-696-0x0000000000010000-0x000000000006D000-memory.dmp
memory/3348-644-0x00000000011D0000-0x00000000011E6000-memory.dmp
memory/4152-937-0x0000000000680000-0x0000000000AB3000-memory.dmp
memory/4152-719-0x0000000000110000-0x00000000001D4000-memory.dmp
memory/4152-709-0x0000000000680000-0x0000000000AB4000-memory.dmp
memory/4152-707-0x0000000000680000-0x0000000000AB4000-memory.dmp
memory/4328-822-0x00000000066A0000-0x0000000006764000-memory.dmp
memory/4328-830-0x00000000066A0000-0x0000000006764000-memory.dmp
memory/4328-864-0x00000000066A0000-0x0000000006764000-memory.dmp
memory/4456-646-0x0000000000400000-0x0000000000454000-memory.dmp
memory/4552-827-0x0000000020DE0000-0x0000000020EA4000-memory.dmp
memory/4552-840-0x0000000020DE0000-0x0000000020EA4000-memory.dmp
memory/4552-858-0x0000000020DE0000-0x0000000020EA4000-memory.dmp
memory/4556-496-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4556-804-0x0000000006330000-0x00000000063F4000-memory.dmp
memory/4792-796-0x0000000000E60000-0x0000000001348000-memory.dmp
memory/4832-807-0x0000000002900000-0x00000000029C4000-memory.dmp
memory/5036-913-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5036-655-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5036-816-0x00000000027F0000-0x00000000028B4000-memory.dmp
memory/5036-601-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5036-911-0x00000000027F0000-0x00000000028B4000-memory.dmp
memory/5228-939-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5228-879-0x0000000000400000-0x0000000000414000-memory.dmp
memory/5456-935-0x0000000000400000-0x00000000004BD000-memory.dmp
memory/5992-943-0x0000000002180000-0x00000000021E6000-memory.dmp