ffdroider | hxxps://fr[.]gridinsoft[.]com/download/antimalware

System Information Discovery

Processes:

gsam-fr-install.exegsam.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	gsam-fr-install.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	gsam.exe

Executes dropped EXE 4 IoCs

Processes:

gsam-fr-install.exeC3272273.JLcgsam.exegsam.exe

pid process

1612 gsam-fr-install.exe
2824 C3272273.JLc
2528 gsam.exe
3152 gsam.exe

pid	process
1612	gsam-fr-install.exe
2824	C3272273.JLc
2528	gsam.exe
3152	gsam.exe

Loads dropped DLL 13 IoCs

Processes:

C3272273.JLcgsam.exeregsvr32.exeregsvr32.exegsam.exe

pid	process
2824	C3272273.JLc
2824	C3272273.JLc
2824	C3272273.JLc
2528	gsam.exe
2528	gsam.exe
4448	regsvr32.exe
3728	regsvr32.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ = "C:\\PROGRA~1\\GRIDIN~1\\shellext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\Unconfirmed 650425.crdownload	upx
behavioral1/memory/1612-122-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/1612-133-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/1612-150-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/1612-297-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/1612-435-0x0000000000400000-0x0000000000655000-memory.dmp	upx
behavioral1/memory/1612-437-0x0000000000400000-0x0000000000655000-memory.dmp	upx

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

Processes:

RUNDLL32.EXERUNDLL32.EXERUNDLL32.EXE

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	RUNDLL32.EXE

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

gsam.exegsam.exe

description	ioc	process
File opened (read-only)	\??\b:	gsam.exe
File opened (read-only)	\??\h:	gsam.exe
File opened (read-only)	\??\e:	gsam.exe
File opened (read-only)	\??\p:	gsam.exe
File opened (read-only)	\??\q:	gsam.exe
File opened (read-only)	\??\u:	gsam.exe
File opened (read-only)	\??\l:	gsam.exe
File opened (read-only)	\??\q:	gsam.exe
File opened (read-only)	\??\a:	gsam.exe
File opened (read-only)	\??\b:	gsam.exe
File opened (read-only)	\??\m:	gsam.exe
File opened (read-only)	\??\w:	gsam.exe
File opened (read-only)	\??\y:	gsam.exe
File opened (read-only)	\??\e:	gsam.exe
File opened (read-only)	\??\i:	gsam.exe
File opened (read-only)	\??\w:	gsam.exe
File opened (read-only)	\??\g:	gsam.exe
File opened (read-only)	\??\j:	gsam.exe
File opened (read-only)	\??\r:	gsam.exe
File opened (read-only)	\??\v:	gsam.exe
File opened (read-only)	\??\u:	gsam.exe
File opened (read-only)	\??\j:	gsam.exe
File opened (read-only)	\??\r:	gsam.exe
File opened (read-only)	\??\t:	gsam.exe
File opened (read-only)	\??\i:	gsam.exe
File opened (read-only)	\??\a:	gsam.exe
File opened (read-only)	\??\g:	gsam.exe
File opened (read-only)	\??\k:	gsam.exe
File opened (read-only)	\??\m:	gsam.exe
File opened (read-only)	\??\p:	gsam.exe
File opened (read-only)	\??\s:	gsam.exe
File opened (read-only)	\??\x:	gsam.exe
File opened (read-only)	\??\z:	gsam.exe
File opened (read-only)	\??\h:	gsam.exe
File opened (read-only)	\??\o:	gsam.exe
File opened (read-only)	\??\z:	gsam.exe
File opened (read-only)	\??\o:	gsam.exe
File opened (read-only)	\??\l:	gsam.exe
File opened (read-only)	\??\n:	gsam.exe
File opened (read-only)	\??\n:	gsam.exe
File opened (read-only)	\??\v:	gsam.exe
File opened (read-only)	\??\y:	gsam.exe
File opened (read-only)	\??\k:	gsam.exe
File opened (read-only)	\??\s:	gsam.exe
File opened (read-only)	\??\t:	gsam.exe
File opened (read-only)	\??\x:	gsam.exe

Drops file in System32 directory 17 IoCs

Processes:

gsam.exeDrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	gsam.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\GSDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET74A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\GSDriver64.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET748F.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET748F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\GSDriver.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET74A0.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET7490.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}\SET7490.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver64.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\GSDriver.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{fdc7b19d-c2fe-0745-a2f2-54c202863363}	DrvInst.exe

Drops file in Program Files directory 64 IoCs

Processes:

C3272273.JLc

description	ioc	process
File created	C:\Program Files\GridinSoft Anti-Malware\whatsnew.dat	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\vietnamese.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\uninst.exe	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\shellext.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplds4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\sqlite3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\azerbaijani.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\croatian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\danish.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\hungarian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\portuguese.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\gsam.exe	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\sqlite3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\ssleay32.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssutil3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\brazilian portuguese.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\finnish.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\libmem.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\pFilters.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\ukrainian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.cat	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\offreg.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssdbm3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\czech.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\dutch.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\polish.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\spanish.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\thai.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\mozcrt19.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\freebl3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\lithuanian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nspr4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\plc4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nssckbi.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\arabic.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\english.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\hebrew.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\plds4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\malaysian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\tkcon.exe	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\nss3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\softokn3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libplc4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\filipino.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\hindi.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\russian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\swedish.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\smime3.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.sys	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\certutil.exe	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\chinese (traditional).lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\japanese.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\romanian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\gsdriver.cat	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\korean.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\slovenian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver64.sys	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\gsInetSecurity.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\bulgarian.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver86.sys	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\NSS\libnspr4.dll	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\greek.lng	C3272273.JLc
File created	C:\Program Files\GridinSoft Anti-Malware\Languages\slovak.lng	C3272273.JLc

Drops file in Windows directory 6 IoCs

Processes:

RUNDLL32.EXEsvchost.exeDrvInst.exeDrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	RUNDLL32.EXE
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 26 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

svchost.exeDrvInst.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

runonce.exegsam.exegsam-fr-install.exerunonce.exerunonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gsam.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gsam-fr-install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	gsam-fr-install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	gsam.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe

Modifies registry class 19 IoCs

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\Clsid	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\InprocServer32\ = "C:\\PROGRA~1\\GRIDIN~1\\shellext.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\shellext.Gridinsoft Anti-Malware\ = "Gridinsoft Anti-Malware"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F77F27A6-89F3-471A-AFA8-3B280940A10C}\ProgID\ = "shellext.Gridinsoft Anti-Malware"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\ShellEx\ContextMenuHandlers\Gridinsoft Anti-Malware	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\Gridinsoft Anti-Malware\ = "{F77F27A6-89F3-471A-AFA8-3B280940A10C}"	regsvr32.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\Unconfirmed 650425.crdownload:SmartScreen msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 650425.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 27 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exepowershell.exegsam.exemsedge.exe

pid	process
220	msedge.exe
220	msedge.exe
4808	msedge.exe
4808	msedge.exe
508	identity_helper.exe
508	identity_helper.exe
1588	msedge.exe
1588	msedge.exe
1440	powershell.exe
1440	powershell.exe
1440	powershell.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3152	gsam.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3648	msedge.exe
3152	gsam.exe
3152	gsam.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4808 msedge.exe
4808 msedge.exe
4808 msedge.exe
4808 msedge.exe
4808 msedge.exe
4808 msedge.exe
4808 msedge.exe
4808 msedge.exe

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

powershell.exegsam.exesvchost.exeDrvInst.exegsam.exe

description	pid	process
Token: SeDebugPrivilege	1440	powershell.exe
Token: SeDebugPrivilege	2528	gsam.exe
Token: SeAuditPrivilege	1220	svchost.exe
Token: SeSecurityPrivilege	1220	svchost.exe
Token: SeRestorePrivilege	3404	DrvInst.exe
Token: SeBackupPrivilege	3404	DrvInst.exe
Token: SeDebugPrivilege	3152	gsam.exe
Token: SeDebugPrivilege	3152	gsam.exe
Token: SeBackupPrivilege	3152	gsam.exe
Token: SeRestorePrivilege	3152	gsam.exe

Suspicious use of FindShellTrayWindow 38 IoCs

Processes:

msedge.exegsam-fr-install.exegsam.exegsam.exe

pid	process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
1612	gsam-fr-install.exe
2528	gsam.exe
3152	gsam.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

gsam-fr-install.exeC3272273.JLcgsam.exegsam.exe

pid process

1612 gsam-fr-install.exe
2824 C3272273.JLc
2528 gsam.exe
2528 gsam.exe
3152 gsam.exe
3152 gsam.exe

pid	process
1612	gsam-fr-install.exe
2824	C3272273.JLc
2528	gsam.exe
2528	gsam.exe
3152	gsam.exe
3152	gsam.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4808 wrote to memory of 4172	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 4172	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2904	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 220	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 220	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe
PID 4808 wrote to memory of 2892	4808	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://fr.gridinsoft.com/download/antimalware
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacec146f8,0x7ffacec14708,0x7ffacec14718
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Users\Admin\Downloads\gsam-fr-install.exe
  "C:\Users\Admin\Downloads\gsam-fr-install.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1612
- - C:\Users\Admin\AppData\Local\Temp\C3272273.JLc
    C:\Users\Admin\AppData\Local\Temp\C3272273.JLc /S /I /D=C:\Program Files\GridinSoft Anti-Malware\
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:2824
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
      4⤵
      PID:1904
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -executionpolicy bypass -noprofile -command "Add-MpPreference -ControlledFolderAccessAllowedApplications ""C:\Program Files\GridinSoft Anti-Malware\gsam.exe"""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1440
  - - C:\Program Files\GridinSoft Anti-Malware\gsam.exe
      "C:\Program Files\GridinSoft Anti-Malware\gsam.exe" -add-shortcut
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Enumerates connected drives
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      PID:2528
  - - C:\Windows\system32\RUNDLL32.EXE
      C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultUninstall 128 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
      4⤵
      Drops file in Drivers directory
      Adds Run key to start application
      PID:4392
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:4844
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4352
  - - C:\Windows\system32\RUNDLL32.EXE
      C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\GSDriver.inf
      4⤵
      Adds Run key to start application
      Drops file in Windows directory
      PID:3752
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:808
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:3228
  - - C:\Windows\system32\RUNDLL32.EXE
      C:\Windows\system32\RUNDLL32.EXE SETUPAPI.DLL,InstallHinfSection DefaultInstall 132 C:\Program Files\GridinSoft Anti-Malware\Driver\gsInetSecurity.inf
      4⤵
      Drops file in Drivers directory
      Adds Run key to start application
      PID:1376
    - - C:\Windows\system32\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:1600
      - C:\Windows\System32\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:4060
  - - C:\Windows\SysWOW64\regsvr32.exe
      "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
      4⤵
      Loads dropped DLL
      PID:4448
    - - C:\Windows\system32\regsvr32.exe
        
        /s "C:\Program Files\GridinSoft Anti-Malware\shellext.dll"
        5⤵
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:3728
- - C:\Program Files\GridinSoft Anti-Malware\gsam.exe
    "C:\Program Files\GridinSoft Anti-Malware\gsam.exe"
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Enumerates connected drives
    - Drops file in System32 directory
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,4650469775113661327,9633161999747290719,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3948 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:880

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1220
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{987b31b5-ac44-574c-aa1c-8a0a8b4aeee4}\GSDriver.inf" "9" "47dc9dfe7" "0000000000000144" "WinSta0\Default" "0000000000000160" "208" "C:\Program Files\GridinSoft Anti-Malware\Driver"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:3592
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\gsdriver.inf_amd64_962c12b9239e9729\gsdriver.inf" "0" "47dc9dfe7" "0000000000000164" "WinSta0\Default"
  2⤵
  - Drops file in Drivers directory
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  PID:3404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery