Overview
overview
10Static
static
7Fake AV/An...09.exe
windows7-x64
7Fake AV/An...09.exe
windows10-2004-x64
7Fake AV/Ana.exe
windows7-x64
8Fake AV/Ana.exe
windows10-2004-x64
7Fake AV/Antivirus.exe
windows7-x64
7Fake AV/Antivirus.exe
windows10-2004-x64
7Fake AV/An...10.exe
windows7-x64
10Fake AV/An...10.exe
windows10-2004-x64
7Fake AV/An...um.exe
windows7-x64
10Fake AV/An...um.exe
windows10-2004-x64
10Fake AV/An...17.exe
windows7-x64
7Fake AV/An...17.exe
windows10-2004-x64
7Fake AV/CleanThis.exe
windows7-x64
Fake AV/CleanThis.exe
windows10-2004-x64
Fake AV/Fa...er.exe
windows7-x64
7Fake AV/Fa...er.exe
windows10-2004-x64
76AdwCleaner.exe
windows7-x64
66AdwCleaner.exe
windows10-2004-x64
6Fake AV/Fi...ll.exe
windows7-x64
7Fake AV/Fi...ll.exe
windows10-2004-x64
7Fake AV/Ha...us.exe
windows7-x64
1Fake AV/Ha...us.exe
windows10-2004-x64
1Fake AV/In...rd.exe
windows7-x64
10Fake AV/In...rd.exe
windows10-2004-x64
9Fake AV/LPS2019.exe
windows7-x64
7Fake AV/LPS2019.exe
windows10-2004-x64
7Fake AV/Mo...eg.exe
windows7-x64
7Fake AV/Mo...eg.exe
windows10-2004-x64
3Fake AV/Na...ld.exe
windows7-x64
3Fake AV/Na...ld.exe
windows10-2004-x64
3Fake AV/PC...er.exe
windows7-x64
Fake AV/PC...er.exe
windows10-2004-x64
10Analysis
- max time kernel
1800s - max time network
1570s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
02/03/2024, 22:38
Behavioral task
behavioral1
Sample
Fake AV/AnViPC2009.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral2
Sample
Fake AV/AnViPC2009.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral3
Sample
Fake AV/Ana.exe
Resource
win7-20240215-en
windows7-x64
20 signatures
1800 seconds
Behavioral task
behavioral4
Sample
Fake AV/Ana.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
13 signatures
1800 seconds
Behavioral task
behavioral5
Sample
Fake AV/Antivirus.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
1800 seconds
Behavioral task
behavioral6
Sample
Fake AV/Antivirus.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral7
Sample
Fake AV/Antivirus2010.exe
Resource
win7-20240221-en
windows7-x64
32 signatures
1800 seconds
Behavioral task
behavioral8
Sample
Fake AV/Antivirus2010.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral9
Sample
Fake AV/AntivirusPlatinum.exe
Resource
win7-20240221-en
windows7-x64
14 signatures
1800 seconds
Behavioral task
behavioral10
Sample
Fake AV/AntivirusPlatinum.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
16 signatures
1800 seconds
Behavioral task
behavioral11
Sample
Fake AV/AntivirusPro2017.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral12
Sample
Fake AV/AntivirusPro2017.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
9 signatures
1800 seconds
Behavioral task
behavioral13
Sample
Fake AV/CleanThis.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
1800 seconds
Behavioral task
behavioral14
Sample
Fake AV/CleanThis.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
1800 seconds
Behavioral task
behavioral15
Sample
Fake AV/FakeAdwCleaner.exe
Resource
win7-20240221-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral16
Sample
Fake AV/FakeAdwCleaner.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
7 signatures
1800 seconds
Behavioral task
behavioral17
Sample
6AdwCleaner.exe
Resource
win7-20240221-en
windows7-x64
3 signatures
1800 seconds
Behavioral task
behavioral18
Sample
6AdwCleaner.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral19
Sample
Fake AV/FileFixPro/FFProInstall.exe
Resource
win7-20240220-en
windows7-x64
5 signatures
1800 seconds
Behavioral task
behavioral20
Sample
Fake AV/FileFixPro/FFProInstall.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral21
Sample
Fake AV/HappyAntivirus.exe
Resource
win7-20240221-en
windows7-x64
2 signatures
1800 seconds
Behavioral task
behavioral22
Sample
Fake AV/HappyAntivirus.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
3 signatures
1800 seconds
Behavioral task
behavioral23
Sample
Fake AV/InternetSecurityGuard.exe
Resource
win7-20240221-en
windows7-x64
26 signatures
1800 seconds
Behavioral task
behavioral24
Sample
Fake AV/InternetSecurityGuard.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
22 signatures
1800 seconds
Behavioral task
behavioral25
Sample
Fake AV/LPS2019.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral26
Sample
Fake AV/LPS2019.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
1800 seconds
Behavioral task
behavioral27
Sample
Fake AV/Movie.mpeg.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
1800 seconds
Behavioral task
behavioral28
Sample
Fake AV/Movie.mpeg.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral29
Sample
Fake AV/NavaShield.exe
Resource
win7-20240221-en
windows7-x64
1 signatures
1800 seconds
Behavioral task
behavioral30
Sample
Fake AV/NavaShield.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
1 signatures
1800 seconds
Behavioral task
behavioral31
Sample
Fake AV/PCDefender.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
1800 seconds
Behavioral task
behavioral32
Sample
Fake AV/PCDefender.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
14 signatures
1800 seconds
General
- Target Fake AV/Antivirus2010.exe
- Size 775KB
- Sample240302-2kwptaae37
- SHA256 1501affdcf557a9dcb73ae34d43365d5301532a48328564160fdc1f3acb01e2e
- MD5 f49bcb5336b1e1212ae82cbb98f8dfe4
- SHA1 fc87518aee297f9c18e40f4604ea048aec0342c4
- SHA512 51a4b1a5ede81e4dbeb9a335fe3a370e6ae452a46d4f4ce8753b37d6e399b00e0de3b066921febf1b5b20f5e3356e0d93da5df366acd2002b792ecb7eb32a7e4
- SSDEEP 12288:msCyG0JUuqby8mkxhZZIQUopL1UnDs1WxWM1W0pdNkFGNjB7tDWYK:j/kxX/ZLwo1WgMPACBv
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies security service 2 TTPs 4 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection = 22020100 Process not Found Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" svchost.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection Process not Found -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\FirewallOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\AntiVirusOverride = "1" svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallOverride = "1" svchost.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\userinit\ImagePath = "\\\\.\\globalroot\\systemroot\\system32\\usеrinit.exe" usеrinit.exe - Deletes itself 1 IoCs
pid Process 2240 cmd.exe - Executes dropped EXE 1 IoCs
pid Process 2088 usеrinit.exe - Loads dropped DLL 1 IoCs
pid Process 1184 Antivirus2010.exe - Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"exefile\" /shell <%1> %*" svchost.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks registry for disk virtualization 3 TTPs 1 IoCs
Detecting virtualization disks is order done to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\SCSI\Disk&Ven_Dell&Prod_VIRTUAL_DISK svchost.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\A: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\H: svchost.exe - Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe Key value enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum svchost.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT usеrinit.exe File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx Process not Found - Suspicious use of NtCreateThreadExHideFromDebugger 31 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe - Suspicious use of SetThreadContext 25 IoCs
description pid Process procid_target PID 1184 set thread context of 2240 1184 Antivirus2010.exe 28 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 PID 2552 set thread context of 296 2552 svchost.exe 16 - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Roaming\Microsoft\SoftwareProtectionPlatform\Cache\cache.dat Process not Found - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_Dell&Prod_THINAIR_DISK svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\SCSI svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\SCSI svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet002\Enum\SCSI\Disk&Ven_Dell&Prod_VIRTUAL_DISK svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svchost.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI svchost.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 svchost.exe - Enumerates system info in registry 2 TTPs 42 IoCs
description ioc Process Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS svchost.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 svchost.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor svchost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2" iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000e36b9a1e442f8c8f6725b3ab2e86b8cce824972b61a47484466df128cb03ab57000000000e800000000200002000000014545c35d3649b8c557029991803bf98ee052d3ae1181e9478ac8c954eb0cd1920000000e0737204118d9fc147030d224eb34ed75c67c21f5325eb1f6901bea7521af88940000000088d61b2fe649af4092b76e2c0a9205da664541ca830bbb5b3a77b72ff335985b953697c36c5b034ad1903df5b1171a1f9280cfde3c911b20f859cfd3ea86ecf iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000112dd71d930ff24b8b2b71a2c228122b00000000020000000000106600000001000020000000aec3497ce80ebdc8702ec829c6e5761c138861876c88f0dc97e6f34b01ba8edc000000000e8000000002000020000000486f2a181d4dc22554c27f1bb57de4100b58fc228badc595b402900fdc0be24f90000000abe46ba6c9ad5c98a7a3021ea503357dca1d16e5b3bcf5bc38e71bc6e892bbea4316f28bd90aaa172cfd143bf914079a23394fdf02d56a88d95c509ea25fcfbeccc171032ae6cae17232693b67fa44ab754d55bea0263cb73cd26311b5e6f82a2d8edb2c069c44d408b35202c4455798be19381a9004e5b16cf8886a7f6f7e591515bcd567b7a7f89cb32f0fe0107b3f40000000ad4ddf11b2094a944c40f24e48c17011e4503ac35b84cefa4a3ae0b5efc1980747212aec0248932d7bf706ebfb0fd03ce74de948f079b84ad4c965134c65de6b iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "415582031" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0a3a4dff46cda01 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{0A868B51-D8E8-11EE-8706-CEEE273A2359} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\SearchScopes iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{32338235-6B2C-4E86-9D3B-C707F6B2A751} svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0083000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" usеrinit.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CRLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{32338235-6B2C-4E86-9D3B-C707F6B2A751}\WpadDecision = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CRLs svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{32338235-6B2C-4E86-9D3B-C707F6B2A751}\WpadDecisionTime = 3010225bf46cda01 svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Disallowed\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{32338235-6B2C-4E86-9D3B-C707F6B2A751}\f2-dc-4f-6f-14-be svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-dc-4f-6f-14-be\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\SmartCardRoot svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{32338235-6B2C-4E86-9D3B-C707F6B2A751}\WpadDecisionReason = "1" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-dc-4f-6f-14-be svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust\CTLs svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-dc-4f-6f-14-be\WpadDecision = "0" svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" usеrinit.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\Main usеrinit.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ usеrinit.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\My svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\trust\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\TrustedPeople svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" svchost.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Policies\Microsoft\SystemCertificates\CA\CTLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\Certificates svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\Root\CRLs svchost.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\SystemCertificates\trust svchost.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" svchost.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f2-dc-4f-6f-14-be\WpadDecisionTime = 3010225bf46cda01 svchost.exe - Modifies registry class 6 IoCs
description ioc Process Key created \registry\machine\Software\Classes\Wow6432Node\Interface\{2ea8c9d4-7b76-aecf-38db-17f923ffdd55} Antivirus2010.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2ea8c9d4-7b76-aecf-38db-17f923ffdd55}\u = "3" Antivirus2010.exe Key created \registry\machine\Software\Classes\Interface\{2ea8c9d4-7b76-aecf-38db-17f923ffdd55} Antivirus2010.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2ea8c9d4-7b76-aecf-38db-17f923ffdd55}\u = "3" Antivirus2010.exe Key created \registry\machine\Software\Classes\Interface\{507e1fac-b73d-1bbf-56af-f783afcbf39c} svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"exefile\" /shell <%1> %*" svchost.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 2088 usеrinit.exe 2088 usеrinit.exe 2088 usеrinit.exe 2088 usеrinit.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe 1924 wmiprvse.exe - Suspicious behavior: MapViewOfSection 32 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1184 Antivirus2010.exe Token: SeSecurityPrivilege 1184 Antivirus2010.exe Token: SeDebugPrivilege 2088 usеrinit.exe Token: SeShutdownPrivilege 1192 Process not Found Token: SeAssignPrimaryTokenPrivilege 832 Process not Found Token: SeIncreaseQuotaPrivilege 832 Process not Found Token: SeSecurityPrivilege 832 Process not Found Token: SeTakeOwnershipPrivilege 832 Process not Found Token: SeLoadDriverPrivilege 832 Process not Found Token: SeSystemtimePrivilege 832 Process not Found Token: SeBackupPrivilege 832 Process not Found Token: SeRestorePrivilege 832 Process not Found Token: SeShutdownPrivilege 832 Process not Found Token: SeSystemEnvironmentPrivilege 832 Process not Found Token: SeUndockPrivilege 832 Process not Found Token: SeManageVolumePrivilege 832 Process not Found Token: SeAssignPrimaryTokenPrivilege 832 Process not Found Token: SeIncreaseQuotaPrivilege 832 Process not Found Token: SeSecurityPrivilege 832 Process not Found Token: SeTakeOwnershipPrivilege 832 Process not Found Token: SeLoadDriverPrivilege 832 Process not Found Token: SeSystemtimePrivilege 832 Process not Found Token: SeBackupPrivilege 832 Process not Found Token: SeRestorePrivilege 832 Process not Found Token: SeShutdownPrivilege 832 Process not Found Token: SeSystemEnvironmentPrivilege 832 Process not Found Token: SeUndockPrivilege 832 Process not Found Token: SeManageVolumePrivilege 832 Process not Found Token: SeAssignPrimaryTokenPrivilege 832 Process not Found Token: SeIncreaseQuotaPrivilege 832 Process not Found Token: SeSecurityPrivilege 832 Process not Found Token: SeTakeOwnershipPrivilege 832 Process not Found Token: SeLoadDriverPrivilege 832 Process not Found Token: SeSystemtimePrivilege 832 Process not Found Token: SeBackupPrivilege 832 Process not Found Token: SeRestorePrivilege 832 Process not Found Token: SeShutdownPrivilege 832 Process not Found Token: SeSystemEnvironmentPrivilege 832 Process not Found Token: SeUndockPrivilege 832 Process not Found Token: SeManageVolumePrivilege 832 Process not Found Token: SeAssignPrimaryTokenPrivilege 832 Process not Found Token: SeIncreaseQuotaPrivilege 832 Process not Found Token: SeSecurityPrivilege 832 Process not Found Token: SeTakeOwnershipPrivilege 832 Process not Found Token: SeLoadDriverPrivilege 832 Process not Found Token: SeSystemtimePrivilege 832 Process not Found Token: SeBackupPrivilege 832 Process not Found Token: SeRestorePrivilege 832 Process not Found Token: SeShutdownPrivilege 832 Process not Found Token: SeSystemEnvironmentPrivilege 832 Process not Found Token: SeUndockPrivilege 832 Process not Found Token: SeManageVolumePrivilege 832 Process not Found Token: SeAssignPrimaryTokenPrivilege 832 Process not Found Token: SeIncreaseQuotaPrivilege 832 Process not Found Token: SeSecurityPrivilege 832 Process not Found Token: SeTakeOwnershipPrivilege 832 Process not Found Token: SeLoadDriverPrivilege 832 Process not Found Token: SeSystemtimePrivilege 832 Process not Found Token: SeBackupPrivilege 832 Process not Found Token: SeRestorePrivilege 832 Process not Found Token: SeShutdownPrivilege 832 Process not Found Token: SeSystemEnvironmentPrivilege 832 Process not Found Token: SeUndockPrivilege 832 Process not Found Token: SeManageVolumePrivilege 832 Process not Found - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 1192 Process not Found 1192 Process not Found 1192 Process not Found 1192 Process not Found 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 1192 Process not Found 1192 Process not Found 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe 2552 svchost.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 1244 iexplore.exe 1244 iexplore.exe 920 IEXPLORE.EXE 920 IEXPLORE.EXE 920 IEXPLORE.EXE 920 IEXPLORE.EXE - Suspicious use of UnmapMainImage 5 IoCs
pid Process 756 Process not Found 588 Process not Found 588 Process not Found 296 svchost.exe 832 Process not Found - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1184 wrote to memory of 2240 1184 Antivirus2010.exe 28 PID 1184 wrote to memory of 2240 1184 Antivirus2010.exe 28 PID 1184 wrote to memory of 2240 1184 Antivirus2010.exe 28 PID 1184 wrote to memory of 2240 1184 Antivirus2010.exe 28 PID 1184 wrote to memory of 2240 1184 Antivirus2010.exe 28 PID 1184 wrote to memory of 2088 1184 Antivirus2010.exe 30 PID 1184 wrote to memory of 2088 1184 Antivirus2010.exe 30 PID 1184 wrote to memory of 2088 1184 Antivirus2010.exe 30 PID 1184 wrote to memory of 2088 1184 Antivirus2010.exe 30 PID 2088 wrote to memory of 2552 2088 usеrinit.exe 31 PID 2088 wrote to memory of 2552 2088 usеrinit.exe 31 PID 2088 wrote to memory of 2552 2088 usеrinit.exe 31 PID 2088 wrote to memory of 2552 2088 usеrinit.exe 31 PID 2088 wrote to memory of 2552 2088 usеrinit.exe 31 PID 2552 wrote to memory of 296 2552 svchost.exe 16 PID 832 wrote to memory of 940 832 Process not Found 32 PID 832 wrote to memory of 940 832 Process not Found 32 PID 832 wrote to memory of 940 832 Process not Found 32 PID 588 wrote to memory of 1924 588 Process not Found 33 PID 588 wrote to memory of 1924 588 Process not Found 33 PID 588 wrote to memory of 1924 588 Process not Found 33 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 2552 wrote to memory of 1244 2552 svchost.exe 34 PID 2552 wrote to memory of 1244 2552 svchost.exe 34 PID 2552 wrote to memory of 1244 2552 svchost.exe 34 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 336 wrote to memory of 1308 336 Process not Found 35 PID 588 wrote to memory of 1308 588 Process not Found 35 PID 588 wrote to memory of 1308 588 Process not Found 35 PID 588 wrote to memory of 1308 588 Process not Found 35 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 1244 wrote to memory of 920 1244 iexplore.exe 36 PID 1244 wrote to memory of 920 1244 iexplore.exe 36 PID 1244 wrote to memory of 920 1244 iexplore.exe 36 PID 1244 wrote to memory of 920 1244 iexplore.exe 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 388 wrote to memory of 920 388 Process not Found 36 PID 336 wrote to memory of 2432 336 Process not Found 37 PID 588 wrote to memory of 2432 588 Process not Found 37 PID 588 wrote to memory of 2432 588 Process not Found 37 PID 588 wrote to memory of 2432 588 Process not Found 37 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 484 wrote to memory of 1244 484 Process not Found 34 PID 388 wrote to memory of 1244 388 Process not Found 34 PID 336 wrote to memory of 980 336 Process not Found 15 PID 336 wrote to memory of 980 336 Process not Found 15 PID 336 wrote to memory of 980 336 Process not Found 15 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵PID:980
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵
- Modifies data under HKEY_USERS
- Suspicious use of UnmapMainImage
PID:296
-
C:\Users\Admin\AppData\Local\Temp\Fake AV\Antivirus2010.exe"C:\Users\Admin\AppData\Local\Temp\Fake AV\Antivirus2010.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1184 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"2⤵
- Deletes itself
PID:2240
-
-
\??\globalroot\systemroot\system32\usеrinit.exe/install2⤵
- Sets service image path in registry
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"3⤵
- Modifies security service
- Windows security bypass
- Modifies system executable filetype association
- Checks registry for disk virtualization
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of SetThreadContext
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2552 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://secure.2010billing.com/purchase/get.php?i=antvir&advert=3&extern=4&lang=EN4⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1244 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1244 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:920
-
-
-
-
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:940
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -Embedding1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1924
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:1308
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{F9717507-6651-4EDB-BFF7-AE615179BCCF}1⤵PID:2432
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Change Default File Association
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
- Size 67KB
- SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
- MD5 753df6889fd7410a2e9fe333da83a429
- SHA1 3c425f16e8267186061dd48ac1c77c122962456e
- SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
- SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 373edd904a50942869f53e05466b0e4916066815c18be31d935bf22ed75c4b44
- MD5 63d95c75ef2baf50d2ae99ba7f7b57cd
- SHA1 ef7b66b9abe71f09ed145db3afcfb918c32866c7
- SHA512 ebd18dbd1074f256811aecab4122f1b7c2e06b7a0d5b58e0174eaefe9111f43ab0c1e6b5e3fb1e988978f1e62af414679ea4f8cd12928df60fac2c1e71feb321
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 498873bada3fdd994b53bfdb8eb6a04c8b30b2601907da6534eb8e03737262df
- MD5 ea6217d6d3e76aa9e56d9fdae81e2071
- SHA1 955b23e6df914560b8475c2dbc7589978656eb31
- SHA512 d0f6f21c475bf604c827590ee5eca2bbd05c3d4449040662785608812559659f420f885d631aacc9fd6bf24fed3bfe1cefbca8a849ceb06f439feaab4b10f5c0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 82c506bea27cd6609ae3e4defdb04b43be7d570371d0320ba0affb7f3af77ba9
- MD5 e00cf7b0f950c82c58309d5465762e6b
- SHA1 28aacfebb97e70bc00509bbed4e4b01d25209073
- SHA512 374be07bfe2ada190938f92c1f70db4904aed2cea569d590bf23cd28bad69d4d5d2ce6fe6bd012724df6e802334ec9444fd83ceff118285cb362488f3c3b05d4
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 a6c96f2afa6f49f97d931c6addf5e84f8a5ae6b610524203947bcc933392aa25
- MD5 10ee30a69486c9c4875774217dca11f8
- SHA1 cc6916b8040c22e6a92f98cf997348e996ce5819
- SHA512 2971abec7e238619f4af8c4359d030b9d31992d38d2fef18e8c93e7ce5391906f6daf510bca6a0fd37aaf51ef554f45274be50200ccf703ba1ad79aa109e1ada
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4d84498fb4db8da945c8ed872caf61c444ea82d3f51816b215e52255289f2e5e
- MD5 4f59ea3fb34ca0fe2f181d7f30a9fc59
- SHA1 5f663984265dfe6352a1b19aa5a6fa3ea54198d9
- SHA512 3c41481064b4cd9c0f45d661dc3ce078a791582c2e85804fbf799e341bd125e436ab52506ac2c43aa3a5e2fbd639fa3dd355b2bf5dd6fb577ff8b4399fe1ebb9
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 7a67aa8f9d88ad91c96e4bcd88eda8bb1b4429e7120e5237ca8c3f483c1ed266
- MD5 37f26b15aac7ef3af6fff672acf88d6f
- SHA1 e9ce6ff5748adb883b7992a7f3c66ab90b9bff3d
- SHA512 3a6ee8139352ca03265d13414afc9c592af42495d42c5bc5bb94d281c4bb6772fee1f89221c5779524988120ea1a5d8ab75581885e2b63ff97535d03ae1bd793
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 083ab225b1256564cc4498c92f5e48af3cd7115590a43799070f55b9a09699b8
- MD5 e97f5c0c2a8c7dcdb6fd132756a29be0
- SHA1 15b958cf2ae127a581ca6bd727c032b06bf4060a
- SHA512 f5c7676a7ac8f8ef97b3b1558cf06cbc882473499e5bfaa05f90c3f6e9d2d6a1418f8743b85dac78669235f4bb79e44ad39fa138da686c271da8d595aaef8460
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 67f4b38fdd501b79ffc454f8d1a7a8852cd8c4e997fabb633f45d40257e8259c
- MD5 634c82b4513c5d97aa4b72e982cada5a
- SHA1 95881392a1c782f1d1f193e1cf78d7a2c6c94b49
- SHA512 411e66ddfc5d49e4c23b5b9efd05293c59b91fb3a3117d84ffe0ea25f25111d198365e1f10f7b60cb71d9cf01ad637c3cd708d9029047fdf299a1bcbf2d73de3
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 1d84532ef38a9a5c90b5aef7f52aaabe2efdc15ea677f515dfb61eb078837fb4
- MD5 033f745f76e9737a22a5c12076b1c3c0
- SHA1 7b34544e70cfa2c3112556ac00d9a85200090013
- SHA512 f145732f27808c8263e06c7267c68e08e78a6b87cf0d464ab817216c4c869f15555b1162e0239c175859f45fc84d3f26e22d55e9aaab2da6e365b68589bd4b5c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 c2468634890450dcef099d550fa5141fb29bbd6b357cd872f398f25d4d92c34b
- MD5 bdb830bea91f5a555c3c9f1f3b430734
- SHA1 c3f73f419b370a5cd7179919450cd12d2537f73d
- SHA512 bbae1c0ed96d28d77c3cfadf8fc3494473416844c948ed370a8fd70f3a2c5b4ab5a8e2df6f17928fa67d30b228cd719c3a17903f361357317daa9cd2dda71edb
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 7f84656251063a022cd5aabc62771416652fd995e660faa18a7b56b126a40bb2
- MD5 c7ab2fdd7f7724b4d7b064598fc9510d
- SHA1 c90f0a36fbcd29cd749733076480564abaf85ca6
- SHA512 32e1cdcb5f0fe3633502ca29911a03aa2be7d7c7042f5b8708d014bb1e49477fd7c7b27153d6d265b5661041aea6f8ee0cd8bb9c78329a36a2af9357baf26b2b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 8e705287b46a90bf854070ba3552b4290404f49777f4ed06ef5578929d058f6a
- MD5 1fa0489469dd7460ec2928646ec65d3a
- SHA1 6f49ac8e48102998152842e73194e5c694d85fb0
- SHA512 33aa5d8444187b39e3dc209f530aa239b4a544a30e49aab87c89f2077f63856af7fa933e5ea912c50ff00820122a571292f567db6a07c5ac33764dbbc87c6be1
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 4aa84982ccadd1ae3828eb71388272ae4db061fcc13bdc5bdcca1b418b780b6b
- MD5 87bbcdc7307feeb17123f215e875c71b
- SHA1 a930b7389a6c691def873345f9ed17e456649ec8
- SHA512 7f0e744203b04d1063d7018b8553b28bade6de595c0c4835e0016625e27196c032c9b43a81ffcbf7c31662edddac97aeaa8fa876125d9b107b1834d43c89e8ed
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 23ba1a98e8ef2b5fbf3de9b5961e40c792433eef7d5210f2e83ce1ab45c8ed5f
- MD5 5b93edbf5f41e1f5b3bdfb5c88bd9555
- SHA1 1a8dc5ed93cc27fafdc04c72a8a52d987a81b1f6
- SHA512 d704c8c3a8470fabf24d103d25a605bbd941ed72bef0f9ea784558b5ba9680c93471f791d9d914165cb0c721d2da7aaf6bec8df8c7ee407fe2cd0c6375303805
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 dcac0934c394eff06821646a18b2fe4b231a44eb83a5826ba5787e35ab44fc88
- MD5 69b443c996039119b6006d2a513d660e
- SHA1 1eb9ccfba22c0a053d8e97122e709c4795375b18
- SHA512 9291f19cee607a86b12ddfe8fba328345ad3e9f2eca63fdf0607d829196f779bae84d8fde3a4bca1c563fc9ba8ba49f07df12f1d8db01f4f50e3b5fa0a77b740
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 839a73018ae7b59f792b31d9f474315544f17c4df3249e039525c33b4efbb21a
- MD5 88669776d02df0b9392b7a96ba1ad530
- SHA1 4fab690c8ca625b06ce36c2dea479023c9b84c12
- SHA512 cd3b0c8c48adadcadabb28813c0cbbd04296a8a037b8e51e7beba9ee5c17e75807f8ef06cb0b131a60c97aa1baabe94a20560623947eda6249d45e6176e1c065
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 6e0699c9db4123227cb7e79709c660ba201881f0cce5d2315f1c3c16b821c9c1
- MD5 13cd5659f68ee7ec7c8512337d30729e
- SHA1 3b06de21711cadb40eadf08551bcf8ad87dd7782
- SHA512 1bc3298b5034dd310cff1d562af3025c19eda3a814276e933496c0be6f3d21500be36141f7ed8e96cc3ecd25f83b44e2239e754c4640f71dba0cf2e01206779e
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 60a9ab1acecaffe456eb135ca2eae42e52faa71e4194f8a215b1008ac0fea09e
- MD5 54285a4526e65377dada6205903ebf5d
- SHA1 51fa7afdcb1459634d6b5cfdd9408a3b4477e1e1
- SHA512 30a5e25c6e287295530da1a8df1a77293209e17d736e8e1ba5076ee3b0040257a93616ef5372101e067a79e78e5f028c2b4ecd7eec8307c0a8d4b20cf6a29dd2
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
- Size 344B
- SHA256 3608203d6ce8b36fb03ac40cf37a9dcc8c0d01e57952da3f23b514d41c266d0d
- MD5 c1e442086588da1e2dee9cbbaec8cd53
- SHA1 f732709799f66bc012554a772f33b9cace098412
- SHA512 069442ab3074935fab2a59ad356f74abaa662016cde4254ff8744da110eeb04d49626c6496a30f0cc4a28115af6ef7370d77961d3bf31e1db97be889629cd0fc
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\CabBEFF.tmp
- Size 65KB
- SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
- MD5 ac05d27423a85adc1622c714f2cb6184
- SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
- SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
- SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TarC1E3.tmp
- Size 175KB
- SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
- MD5 dd73cead4b93366cf3465c8cd32e2796
- SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
- SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
- SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\{E9C1E0AC-C9B1-4c85-94DE-9C1518918D02}.tlb
- Size 2KB
- SHA256 50d712b007a3339855619a4ad283661c07e13ec0a74465ea3d121439005cd1e5
- MD5 63881935b6ff930a39df13a27c18c3f5
- SHA1 d5464ca24d61b2efb562b1b4f4e0bef69c94cf04
- SHA512 011d0307d088ac7a691ff504f8c3e99a06097fc27e10d40d62721cf6c6d0500120d040a7d32fd10aa50aeef1ef12be67501fff122bed129a354fb57c213a0ed9
- MD5 SHA1 SHA512
- Path C:\Windows\System32\exefile.exe
- Size 115KB
- SHA256 09cd3c864182b703a1384a15e60424c0ee8c82c3fd19f197c391a0e3ec5bd16e
- MD5 72178bb0f9674f0ce0b6b188d1219266
- SHA1 ae3c43c7846c0ef977fa90991e1c366e34ab671c
- SHA512 d9004c1b8402375c92690525f06ae83198bb929bb18dfc46fda9036a4054ed9c38637438b13ecc2566f98f2a8ac297ec7f0151b63a59c4f7bbc2ab8f7b6d779e
- SSDEEP 3072:ejrarXjL4iGdlEkOtoBXnyW1wz+9BDCYPFW7B/:YarXjsfAoBu+DAB
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\winevt\Logs\Microsoft-Windows-Kernel-EventTracing%4Admin.evtx
- Size 68KB
- SHA256 2c5af935a6aa5a84ccf281b70fc33696e17f514433bbfcb5f99001a654a35730
- MD5 3d9c07539df65f271c6f796ecd8a5a25
- SHA1 df81120bbe93431f064d634f221309c5b129c73d
- SHA512 921b4bf60e6b2bd0997a95918897a842bcd1e7ca3256aefd89f669b5dc8a25522fd8bfec99888825e317f574cf030de0d5aca11a6c67ac16e2dad9d7b2f1deee
- SSDEEP 384:tnhX5U25jh5gZ5V5O5m5G585f5m5t5S5U5K5R5u5g5GXZol9/G5:Fkk5a
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\System32\usеrinit.exe
- Size 139KB
- SHA256 29b5b65a1cdf119ac7c6c9df76c6843b25a81bd00aa5a5e995ec675e34bf1acb
- MD5 4acd14244d2cd76d06939163127cfb10
- SHA1 75f3e3c764f7d20c9950f5410f753f3210bcc2e7
- SHA512 001504da15c1825102479ba379b0be7ec15e779626d450d9d763552d7e1ac71f5bb86110f9361363bd401aabc53cdfd2d554480aec8bef85ed8c7b03cebf4031
- SSDEEP 3072:b/3VPjhXdnXuWD3sQg4q0sA+j42SWX3rfxzpai:PXBnDIj42N1ai
- MD5 SHA1 SHA512 SSDEEP
- Path \systemroot\system32\msiavjyv.dll
- Size 718KB
- SHA256 be8dbcb59c3181ec518a6934931efc725a128310956fd076f0f0bd537b96a9eb
- MD5 7943d251821ca441924f0d64946e8a3d
- SHA1 cace099a490410260802ee143f7c7e3543f2f4cf
- SHA512 0d4c9f021e07e2a27f3e7f46be591f01ec4c04fce98d9c177697ea4518d0c8d80105d73a29deff925cf28fce89a4fe40e790ef0086748dc169b1a8190e6d40f9
- SSDEEP 12288:ZG72UHV6ULmwRAe605Ej2IWAqp+6JpvDi+2lXjIyvPO2RYtd7r:UCUHHLmwo5Whp+6nbi+22ytRYzv
- MD5 SHA1 SHA512 SSDEEP