cerber | hxxps://www[.]dropbox[.]com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\Annabelle.exe"	Annabelle.exe

Modifies Windows Defender Real-time Protection settings 3 TTPs 2 IoCs

evasion trojan

Modify Registry

Windows Service

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Annabelle.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	Annabelle.exe

Netwire
Netwire is a RAT with main functionalities focused password stealing and keylogging, but also includes remote control capabilities as well.
botnet stealer netwire

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	Annabelle.exe

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

ModiLoader First Stage 1 IoCs

resource	yara_rule
behavioral2/memory/2828-2839-0x0000000010410000-0x000000001047E000-memory.dmp	modiloader_stage1

Contacts a large (1239) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Disables RegEdit via registry modification 2 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	Annabelle.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Downloads MZ/PE file

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\drivers\JitDriver.sys	bmaha12t.c04
File opened for modification	C:\Windows\system32\drivers\JitDriver.sys	bmaha12t.c04

Modifies Windows Firewall 2 TTPs 4 IoCs

evasion

Windows Service

Disable or Modify System Firewall

T1562.004

pid	Process
2348	netsh.exe
6480	NetSh.exe
7136	netsh.exe
6032	netsh.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\url.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cabinet.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gpedit.msc\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dllhost.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll32.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\usbui.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ksuser.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\shellstyle.dll	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mydocs.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DBGHELP.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webcheck.dll	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\systemexplorer.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\DCIMAN32.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mpg4dmod.dll\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rundll.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chkdsk.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmplayer.exe	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\secpol.msc	Annabelle.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	Annabelle.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	Annabelle.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000100000002aa70-2899.dat	acprotect

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:Zone.Identifier:$DATA	NJRat.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe	NJRat.exe

Executes dropped EXE 12 IoCs

pid	Process
2812	6AdwCleaner.exe
3596	dlrarhsiva.exe
2436	dlrarhsiva.exe
4972	vc_redist.exe
2568	vc_redist.exe
1756	VC_redist.x64.exe
5224	smss.exe
6780	DSOneWeb.exe
5844	WicAnimatedGif.exe
7108	DSOneWeb.exe
3268	bmaha12t.c04
316	DSOneWebWD.exe

Loads dropped DLL 46 IoCs

pid	Process
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
2568	vc_redist.exe
780	VC_redist.x64.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6668	DriverUpdate.exe
6668	DriverUpdate.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
6780	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
316	DSOneWebWD.exe
316	DSOneWebWD.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/6428-1312-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/6428-1310-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/memory/6428-1315-0x0000000000400000-0x0000000000438000-memory.dmp	upx
behavioral2/files/0x000100000002aa70-2899.dat	upx

Adds Run key to start application 2 TTPs 26 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta"	NetWire.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto"	6AdwCleaner.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\NJRat.exe\" .."	NJRat.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "smss\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\Csrss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UpdateBackup = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp2_stuff.zip\\Annabelle.exe"	Annabelle.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\smss = "c:\\RECYCLER\\smss.exe "	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\{3746f21b-c990-4045-bb33-1cf98cff7a68} = "\"C:\\ProgramData\\Package Cache\\{3746f21b-c990-4045-bb33-1cf98cff7a68}\\VC_redist.x64.exe\" /burn.runonce"	VC_redist.x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\k:	Cerber5.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\e:	Cerber5.exe
File opened (read-only)	\??\j:	Cerber5.exe
File opened (read-only)	\??\n:	Cerber5.exe
File opened (read-only)	\??\r:	Cerber5.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\a:	Cerber5.exe
File opened (read-only)	\??\s:	Cerber5.exe
File opened (read-only)	\??\v:	Cerber5.exe
File opened (read-only)	\??\w:	Cerber5.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\h:	Cerber5.exe
File opened (read-only)	\??\y:	Cerber5.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\b:	Cerber5.exe
File opened (read-only)	\??\o:	Cerber5.exe
File opened (read-only)	\??\p:	Cerber5.exe
File opened (read-only)	\??\q:	Cerber5.exe
File opened (read-only)	\??\t:	Cerber5.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\g:	Cerber5.exe
File opened (read-only)	\??\z:	Cerber5.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\l:	Cerber5.exe
File opened (read-only)	\??\m:	Cerber5.exe
File opened (read-only)	\??\u:	Cerber5.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\i:	Cerber5.exe
File opened (read-only)	\??\x:	Cerber5.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 5 IoCs

Web Service

T1102

flow	ioc
22	dropbox.com
261	drive.google.com
366	drive.google.com
18	dropbox.com
21	dropbox.com

Drops autorun.inf file 1 TTPs 6 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	\??\d:\autorun.INF	smss.exe
File opened for modification	\??\e:\autorun.INF	smss.exe
File opened for modification	\??\c:\autorun.INF	smss.exe
File opened for modification	\??\f:\autorun.INF	smss.exe
File opened for modification	\??\c:\RECYCLER:\autorun.INF	smss.exe
File opened for modification	\??\c:\RECYCLER\autorun.INF	smss.exe

Drops file in System32 directory 50 IoCs

description	ioc	Process
File created	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File created	C:\Windows\system32\vcomp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcomp140.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140.dll	msiexec.exe
File created	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_2.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140jpn.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcamp140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140.dll	msiexec.exe
File created	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140u.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140deu.dll	msiexec.exe
File created	C:\Windows\system32\mfcm140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140kor.dll	msiexec.exe
File created	C:\Windows\system32\vcruntime140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140esn.dll	msiexec.exe
File created	C:\Windows\system32\mfc140ita.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_atomic_wait.dll	msiexec.exe
File created	C:\Windows\system32\msvcp140_1.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140u.dll	msiexec.exe
File created	C:\Windows\system32\mfc140enu.dll	msiexec.exe
File created	C:\Windows\system32\mfc140rus.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140fra.dll	msiexec.exe
File created	C:\Windows\system32\concrt140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File opened for modification	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\msvcp140_codecvt_ids.dll	msiexec.exe
File created	C:\Windows\system32\mfc140chs.dll	msiexec.exe
File created	C:\Windows\system32\mfc140cht.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vcruntime140.dll	msiexec.exe
File opened for modification	C:\Windows\system32\vccorlib140.dll	msiexec.exe
File created	C:\Windows\system32\vccorlib140.dll	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Control Panel\Desktop\Wallpaper = "0"	$uckyLocker.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2828 set thread context of 5420	2828	NetWire.exe	278

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Driver Support One\System.Text.Json.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\cefsharp.winforms.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DotNetty.Transport.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\sqlite3.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\ProductInfo.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Http.Connections.Common.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.Logging.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.ObjectPool.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.Configuration.Binder.dll	DSOneWeb.exe
File opened for modification	C:\Program Files (x86)\Driver Support One\DBPersist-temp.db	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\bmaha12t.c04	DSOneWeb.exe
File created	\??\c:\Program Files\Messenger\msmsgs.exe	smss.exe
File created	C:\Program Files (x86)\Driver Support One\DSOneWebInstall.gif	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\WebSocketLib.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\EntityFramework.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Asurvio.Client.Common.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.FileProviders.Abstractions.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DriverSupport.One.Service.Model.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DriverInstaller.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Http.Connections.Client.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Http.Connections.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.SignalR.Client.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Azure.Devices.Shared.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Azure.Documents.ServiceInterop.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DotNetty.Codecs.Mqtt.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\System.Buffers.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\libegl.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.Logging.Abstractions.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DocumentModel.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Authentication.Abstractions.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Authorization.Policy.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DSOne.exe	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\icudtl.dat	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\snapshot_blob.bin	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\HookLib.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DotNetty.Common.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\System.Runtime.CompilerServices.Unsafe.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\AsurvioSnmpLib.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\cefsharp.core.runtime.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\startagent.vbs	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Connections.Abstractions.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\System.Numerics.Vectors.dll	DSOneWeb.exe
File opened for modification	C:\Program Files (x86)\Driver Support One\TelemetryPersist.db	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\sqlite.db	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DSOneWebWD.exe	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Extensions.Logging.Console.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\cefsharp.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\vk_swiftshader.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DotNetty.Codecs.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.Http.Extensions.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.WindowsAPICodePack.Shell.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\ValueProp.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\ServiceLib.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.SignalR.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.AspNetCore.WebSockets.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\System.Text.Encodings.Web.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\libglesv2.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\DotNetty.Buffers.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Asurvio.Common.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\SQLite.Interop.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\Microsoft.Owin.dll	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\3rdparty.txt	DSOneWeb.exe
File created	C:\Program Files (x86)\Driver Support One\JitDriverLib.dll	DSOneWeb.exe

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF457B5A06E2678512.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{F4499EE3-A166-496C-81BB-51D1BCDC70A9}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3F87.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF79774C5DCA66FC9.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI39E7.tmp	msiexec.exe
File created	C:\Windows\Installer\e623882.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{3407B900-37F5-4CC2-B612-5CD5D580A163}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF737E54A2F81C2588.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e623883.msi	msiexec.exe
File opened for modification	C:\Windows\smss.exe	Nadlote.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF34990D76A36F123B.TMP	msiexec.exe
File created	C:\Windows\Installer\e623883.msi	msiexec.exe
File created	C:\Windows\Installer\e623898.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA6C82E14B71D1B7A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF95D1C67DED5072D.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3B20.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBF385B7B0BF26F56.TMP	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD99639A5625E456A.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3E7C.tmp	msiexec.exe
File created	C:\Windows\smss.exe	Nadlote.exe
File opened for modification	C:\Windows\smss.exe	smss.exe
File created	C:\Windows\Installer\e623870.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e623870.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5388	6428	WerFault.exe	159

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000fb1a9eb37f5a4fba0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000fb1a9eb30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900fb1a9eb3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dfb1a9eb3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000fb1a9eb300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

Command and Scripting Interpreter

T1059

pid	Process
6236	ipconfig.exe

Interacts with shadow copies 2 TTPs 3 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
6004	vssadmin.exe
2596	vssadmin.exe
3940	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 29 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2752781940"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31096996"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13"	iexplore.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEMINIMUMVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3EE9944F661AC69418BB151DCBCD079A\Servicing_Key	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Net	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8800A266DCF6DD54E97A86760485EA5D	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\ = "{F4499EE3-A166-496C-81BB-51D1BCDC70A9}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\ = "{3746f21b-c990-4045-bb33-1cf98cff7a68}"	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\PackageCode = "2E26CECC343D09D4AA024D443BCB4FF1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\PackageName = "vc_runtimeAdditional_x64.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{F4499EE3-A166-496C-81BB-51D1BCDC70A9}v14.32.31332\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2930051783-2551506282-3430162621-1000\{BF41B47C-4234-46F0-80AD-966EF74947CE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\009B70435F732CC46B21C55D5D081A36\VC_Runtime_Minimum	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.32.31332"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\ProductName = "Microsoft Visual C++ 2022 X64 Minimum Runtime - 14.32.31332"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\Language = "1033"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8800A266DCF6DD54E97A86760485EA5D\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\Version = "237009508"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{F4499EE3-A166-496C-81BB-51D1BCDC70A9}v14.32.31332\\packages\\vcRuntimeAdditional_amd64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\DeploymentFlags = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\SourceList\Media	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Media\1 = ";"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\Net\1 = "C:\\ProgramData\\Package Cache\\{3407B900-37F5-4CC2-B612-5CD5D580A163}v14.32.31332\\packages\\vcRuntimeMinimum_amd64\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\InstanceType = "0"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\Clients = 3a0000000000	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.30,bundle	VC_redist.x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\VC,redist.x64,amd64,14.32,bundle\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68}	VC_redist.x64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\09A86F63C932FD435BC8463B1035EC53\009B70435F732CC46B21C55D5D081A36	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeMinimumVSU_amd64,v14\Dependents\{3746f21b-c990-4045-bb33-1cf98cff7a68}	VC_redist.x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\3EE9944F661AC69418BB151DCBCD079A	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\CLASSES\INSTALLER\DEPENDENCIES\MICROSOFT.VS.VC_RUNTIMEADDITIONALVSU_AMD64,V14\DEPENDENTS\{57A73DF6-4BA9-4C1D-BBBB-517289FF6C13}	VC_redist.x64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\009B70435F732CC46B21C55D5D081A36\SourceList\PackageName = "vc_runtimeMinimum_x64.msi"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\8A567BD6FA501A947AD1F646E53EEC14\SourceList\Net	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\3EE9944F661AC69418BB151DCBCD079A\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2930051783-2551506282-3430162621-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\009B70435F732CC46B21C55D5D081A36\Provider	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\009B70435F732CC46B21C55D5D081A36\Servicing_Key	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\8A567BD6FA501A947AD1F646E53EEC14	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Dependencies\Microsoft.VS.VC_RuntimeAdditionalVSU_amd64,v14\DisplayName = "Microsoft Visual C++ 2022 X64 Additional Runtime - 14.32.31332"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\88AAB0B9F51EF1A3CA0C2B609EDD7FC1\3EE9944F661AC69418BB151DCBCD079A	msiexec.exe

Modifies registry key 1 TTPs 19 IoCs

Modify Registry

pid	Process
3888	reg.exe
2464	reg.exe
796	reg.exe
6744	reg.exe
2872	reg.exe
732	reg.exe
2988	reg.exe
1208	reg.exe
6128	reg.exe
2396	reg.exe
2036	reg.exe
4552	reg.exe
6784	reg.exe
1204	reg.exe
576	reg.exe
5652	reg.exe
3476	reg.exe
5316	reg.exe
2812	reg.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 5c00000001000000040000000008000019000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b0400000001000000100000001d3554048578b03f42424dbf20730a3f20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868	6AdwCleaner.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0400000001000000100000001d3554048578b03f42424dbf20730a3f0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186819000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604	6AdwCleaner.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\stuff.zip:Zone.Identifier	msedge.exe
File opened for modification	\??\c:\RECYCLER:\autorun.INF	smss.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
1064	NOTEPAD.EXE

Runs net.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
4264	PING.EXE

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
4876	vlc.exe
4140	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1448	msedge.exe
1448	msedge.exe
3952	msedge.exe
3952	msedge.exe
3800	msedge.exe
3800	msedge.exe
2100	identity_helper.exe
2100	identity_helper.exe
412	msedge.exe
412	msedge.exe
2684	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
5820	msedge.exe
6780	msedge.exe
6780	msedge.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
6304	msiexec.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe
7068	NJRat.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4876	vlc.exe
4140	vlc.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
684	Process not Found
684	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 50 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2812	6AdwCleaner.exe
Token: SeBackupPrivilege	2032	vssvc.exe
Token: SeRestorePrivilege	2032	vssvc.exe
Token: SeAuditPrivilege	2032	vssvc.exe
Token: SeShutdownPrivilege	1756	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	1756	VC_redist.x64.exe
Token: SeSecurityPrivilege	6304	msiexec.exe
Token: SeCreateTokenPrivilege	1756	VC_redist.x64.exe
Token: SeAssignPrimaryTokenPrivilege	1756	VC_redist.x64.exe
Token: SeLockMemoryPrivilege	1756	VC_redist.x64.exe
Token: SeIncreaseQuotaPrivilege	1756	VC_redist.x64.exe
Token: SeMachineAccountPrivilege	1756	VC_redist.x64.exe
Token: SeTcbPrivilege	1756	VC_redist.x64.exe
Token: SeSecurityPrivilege	1756	VC_redist.x64.exe
Token: SeTakeOwnershipPrivilege	1756	VC_redist.x64.exe
Token: SeLoadDriverPrivilege	1756	VC_redist.x64.exe
Token: SeSystemProfilePrivilege	1756	VC_redist.x64.exe
Token: SeSystemtimePrivilege	1756	VC_redist.x64.exe
Token: SeProfSingleProcessPrivilege	1756	VC_redist.x64.exe
Token: SeIncBasePriorityPrivilege	1756	VC_redist.x64.exe
Token: SeCreatePagefilePrivilege	1756	VC_redist.x64.exe
Token: SeCreatePermanentPrivilege	1756	VC_redist.x64.exe
Token: SeBackupPrivilege	1756	VC_redist.x64.exe
Token: SeRestorePrivilege	1756	VC_redist.x64.exe
Token: SeShutdownPrivilege	1756	VC_redist.x64.exe
Token: SeDebugPrivilege	1756	VC_redist.x64.exe
Token: SeAuditPrivilege	1756	VC_redist.x64.exe
Token: SeSystemEnvironmentPrivilege	1756	VC_redist.x64.exe
Token: SeChangeNotifyPrivilege	1756	VC_redist.x64.exe
Token: SeRemoteShutdownPrivilege	1756	VC_redist.x64.exe
Token: SeUndockPrivilege	1756	VC_redist.x64.exe
Token: SeSyncAgentPrivilege	1756	VC_redist.x64.exe
Token: SeEnableDelegationPrivilege	1756	VC_redist.x64.exe
Token: SeManageVolumePrivilege	1756	VC_redist.x64.exe
Token: SeImpersonatePrivilege	1756	VC_redist.x64.exe
Token: SeCreateGlobalPrivilege	1756	VC_redist.x64.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe
Token: SeRestorePrivilege	6304	msiexec.exe
Token: SeTakeOwnershipPrivilege	6304	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SendNotifyMessage 31 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4876	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
4140	vlc.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe
7108	DSOneWeb.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2812	6AdwCleaner.exe
2812	6AdwCleaner.exe
4876	vlc.exe
6328	MiniSearchHost.exe
4140	vlc.exe
6668	DriverUpdate.exe
4972	vc_redist.exe
2568	vc_redist.exe
1756	VC_redist.x64.exe
6424	VC_redist.x64.exe
780	VC_redist.x64.exe
6504	VC_redist.x64.exe
3424	Nadlote.exe
5224	smss.exe
6780	DSOneWeb.exe
5844	WicAnimatedGif.exe
5844	WicAnimatedGif.exe
3268	bmaha12t.c04

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2368	3952	msedge.exe	76
PID 3952 wrote to memory of 2368	3952	msedge.exe	76
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 332	3952	msedge.exe	77
PID 3952 wrote to memory of 1448	3952	msedge.exe	78
PID 3952 wrote to memory of 1448	3952	msedge.exe	78
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79
PID 3952 wrote to memory of 3076	3952	msedge.exe	79

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.dropbox.com/scl/fo/qy2qk79x2gtuwswxjxcla/h?rlkey=9ophpx1zlqaopl8j3d53sf3wi&dl=0
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd76a73cb8,0x7ffd76a73cc8,0x7ffd76a73cd8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaService --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6904 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1720 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7208 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8064 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8656 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8628 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8820 /prefetch:1
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9000 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8948 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8852 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9324 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9644 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9652 /prefetch:1
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9988 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10148 /prefetch:1
  2⤵
  PID:5728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10380 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10696 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10708 /prefetch:1
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10688 /prefetch:1
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8352 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10372 /prefetch:1
  2⤵
  PID:6832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=10744 /prefetch:1
  2⤵
  PID:6176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8608 /prefetch:1
  2⤵
  PID:6304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=7344 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1928,12097668597864803262,18176818948063923853,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  PID:6780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2604

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4532

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_stuff.zip\BobuxGenerator.exe.vbs"
1⤵
PID:3512

C:\Users\Admin\AppData\Local\Temp\Temp1_stuff.zip\AdwereCleaner.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_stuff.zip\AdwereCleaner.exe"
1⤵
PID:5688
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2812

C:\Users\Admin\AppData\Local\Temp\Temp1_stuff.zip\CrimsonRAT.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_stuff.zip\CrimsonRAT.exe"
1⤵
PID:6380
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:3596

C:\Users\Admin\Desktop\stuff\CrimsonRAT.exe
"C:\Users\Admin\Desktop\stuff\CrimsonRAT.exe"
1⤵
PID:6916
- C:\ProgramData\Hdlharas\dlrarhsiva.exe
  "C:\ProgramData\Hdlharas\dlrarhsiva.exe"
  2⤵
  - Executes dropped EXE
  PID:2436

C:\Users\Admin\Desktop\stuff\Birele.exe
"C:\Users\Admin\Desktop\stuff\Birele.exe"
1⤵
PID:6428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6428 -s 232
  2⤵
  - Program crash
  PID:5388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6428 -ip 6428
1⤵
PID:1408

C:\Users\Admin\Desktop\stuff\$uckyLocker.exe
"C:\Users\Admin\Desktop\stuff\$uckyLocker.exe"
1⤵
- Sets desktop wallpaper using registry
PID:6564

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\InvokeTrace.M2TS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4876

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6328

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\SaveUnlock.xsl
1⤵
- Modifies Internet Explorer settings
PID:5328

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\InvokeTrace.M2TS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:6084
- C:\Windows\system32\Taskmgr.exe
  taskmgr
  2⤵
  PID:72

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\d36845b39e5446ab96148a12d849d281 /t 5416 /p 2812
1⤵
PID:5208

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\EternalRocks.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\EternalRocks.exe"
1⤵
PID:4372

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:6668
- C:\Users\Admin\AppData\Local\Temp\vc_redist.exe
  "C:\Users\Admin\AppData\Local\Temp\vc_redist.exe" /install /quiet /norestart
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4972
- - C:\Windows\Temp\{956D6543-5E76-4CE7-9E4B-3040C14AFB74}\.cr\vc_redist.exe
    "C:\Windows\Temp\{956D6543-5E76-4CE7-9E4B-3040C14AFB74}\.cr\vc_redist.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\vc_redist.exe" -burn.filehandle.attached=600 -burn.filehandle.self=576 /install /quiet /norestart
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:2568
  - - C:\Windows\Temp\{62537119-1085-4A19-BFC9-7DAA920255C5}\.be\VC_redist.x64.exe
      "C:\Windows\Temp\{62537119-1085-4A19-BFC9-7DAA920255C5}\.be\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{A69539A0-B080-4A0F-800D-CEF4050CF984} {ED464A0B-AD53-49B6-8AE5-688E200E1F80} 2568
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1756
    - - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -uninstall -quiet -burn.related.upgrade -burn.ancestors={3746f21b-c990-4045-bb33-1cf98cff7a68} -burn.filehandle.self=980 -burn.embedded BurnPipe.{F270F598-81C6-4D74-AF02-36ACCCB33869} {CBEF6BC3-96C6-4BE4-B192-5948F3349DEF} 1756
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:6424
      - C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -burn.filehandle.attached=572 -burn.filehandle.self=588 -uninstall -quiet -burn.related.upgrade -burn.ancestors={3746f21b-c990-4045-bb33-1cf98cff7a68} -burn.filehandle.self=980 -burn.embedded BurnPipe.{F270F598-81C6-4D74-AF02-36ACCCB33869} {CBEF6BC3-96C6-4BE4-B192-5948F3349DEF} 1756
        6⤵
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:780
        
        C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe
        
        "C:\ProgramData\Package Cache\{57a73df6-4ba9-4c1d-bbbb-517289ff6c13}\VC_redist.x64.exe" -q -burn.elevated BurnPipe.{474592DC-4B5B-453A-B36C-B8537B530EB9} {C07F15C1-63E2-4574-9C9C-D93E8CC2DD27} 780
        7⤵
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:6504
- C:\Users\Admin\AppData\Local\Temp\DSOneWeb.exe
  "C:\Users\Admin\AppData\Local\Temp\DSOneWeb.exe" /LANGUAGE:1033 /WELCOME_SHOWN:true /AGREE_TO_LICENSE:true /TID: /BOOTSTRAPPERPATH:"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of SetWindowsHookEx
  PID:6780
- - C:\Program Files (x86)\Driver Support One\WicAnimatedGif.exe
    "C:\Program Files (x86)\Driver Support One\WicAnimatedGif.exe" -file DSOneWebInstall.Gif -timeout 120
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5844
- - C:\Program Files (x86)\Driver Support One\DSOneWeb.exe
    "C:\Program Files (x86)\Driver Support One\DSOneWeb.exe" -frontUrl:"https://front.driversupport.com" -channel:"gdn_ds1web" -install=true /epid:6780 /installPackagePath:"C:\Users\Admin\AppData\Local\Temp\DSOneWeb.exe" /updated:false /bootStrapperPath:"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe" /installerID:{EAE73048-BB6F-4F30-A9D4-02EE0AB54C8D}
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Suspicious use of SendNotifyMessage
    PID:7108
  - - C:\Program Files (x86)\Driver Support One\bmaha12t.c04
      "C:\Program Files (x86)\Driver Support One\bmaha12t.c04"
      4⤵
      Drops file in Drivers directory
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3268
  - - C:\Program Files (x86)\Driver Support One\DSOneWebWD.exe
      "C:\Program Files (x86)\Driver Support One\DSOneWebWD.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:316
  - - C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe
      "C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe" --type=gpu-process --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\ProgramData\Asurvio\DSOneWeb\guicache" --cefsharpexitsub --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --use-gl=angle --use-angle=swiftshader-webgl --log-file="C:\Program Files (x86)\Driver Support One\debug.log" --mojo-platform-channel-handle=5180 --field-trial-handle=5188,i,9247253976228605378,15296383489195577738,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:2 --host-process-id=7108
      4⤵
      PID:5888
  - - C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe
      "C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\ProgramData\Asurvio\DSOneWeb\guicache" --cefsharpexitsub --log-file="C:\Program Files (x86)\Driver Support One\debug.log" --mojo-platform-channel-handle=5432 --field-trial-handle=5188,i,9247253976228605378,15296383489195577738,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 --host-process-id=7108
      4⤵
      PID:4268
  - - C:\Program Files (x86)\Driver Support One\tpfc54ov.tkr
      "C:\Program Files (x86)\Driver Support One\tpfc54ov.tkr"
      4⤵
      PID:6656
  - - C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe
      "C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-sandbox --log-severity=disable --lang=en-US --user-data-dir="C:\ProgramData\Asurvio\DSOneWeb\guicache" --cefsharpexitsub --log-file="C:\Program Files (x86)\Driver Support One\debug.log" --mojo-platform-channel-handle=6244 --field-trial-handle=5188,i,9247253976228605378,15296383489195577738,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI /prefetch:8 --host-process-id=7108
      4⤵
      PID:7124
  - - C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe
      "C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe" --type=renderer --log-severity=disable --user-data-dir="C:\ProgramData\Asurvio\DSOneWeb\guicache" --cefsharpexitsub --first-renderer-process --no-sandbox --log-file="C:\Program Files (x86)\Driver Support One\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=6392 --field-trial-handle=5188,i,9247253976228605378,15296383489195577738,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --host-process-id=7108 /prefetch:1
      4⤵
      PID:1260
  - - C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe
      "C:\Program Files (x86)\Driver Support One\CefSharp.BrowserSubprocess.exe" --type=renderer --log-severity=disable --user-data-dir="C:\ProgramData\Asurvio\DSOneWeb\guicache" --cefsharpexitsub --no-sandbox --log-file="C:\Program Files (x86)\Driver Support One\debug.log" --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=6640 --field-trial-handle=5188,i,9247253976228605378,15296383489195577738,262144 --disable-features=BackForwardCache,CalculateNativeWinOcclusion,DocumentPictureInPictureAPI --host-process-id=7108 /prefetch:1
      4⤵
      PID:4924

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2032

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
PID:3392

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6304

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Nadlote.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Nadlote.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3424
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1892
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:5652
- C:\Windows\SysWOW64\CMD.exe
  CMD /C "c:\RECYCLER\smss.exe"
  2⤵
  PID:5404
- - \??\c:\RECYCLER\smss.exe
    c:\RECYCLER\smss.exe
    3⤵
    - Executes dropped EXE
    - Drops autorun.inf file
    - Drops file in Program Files directory
    - Drops file in Windows directory
    - NTFS ADS
    - Suspicious use of SetWindowsHookEx
    PID:5224
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2260
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:3888
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3812
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1204
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:756
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:5316
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:6192
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1208
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ipconfig > c:\RECYCLER\IP.dlx
      4⤵
      PID:5840
    - - C:\Windows\SysWOW64\ipconfig.exe
        
        ipconfig
        5⤵
        Gathers network information
        
        PID:6236
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:4004
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:6128
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c net share Love2="c:\Documents and Settings" /unlimited | net share Love1=C:\Windows /unlimited | net share Love3=d:\ /unlimited
      4⤵
      PID:3788
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love2="c:\Documents and Settings" /unlimited
        5⤵
        
        PID:4924
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love2="c:\Documents and Settings" /unlimited
        6⤵
        
        PID:6656
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love1=C:\Windows /unlimited
        5⤵
        
        PID:3488
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love1=C:\Windows /unlimited
        6⤵
        
        PID:6716
    - - C:\Windows\SysWOW64\net.exe
        
        net share Love3=d:\ /unlimited
        5⤵
        
        PID:5708
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 share Love3=d:\ /unlimited
        6⤵
        
        PID:4880
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f
      4⤵
      PID:3316
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "smss\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:576
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:6664
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:3828
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:4552
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:1832
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2872
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:6848
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:732
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ping ernet adapter E0 -n 2 -w 3 > "c:\RECYCLER\check_4_online.dlx"
      4⤵
      PID:3140
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping ernet adapter E0 -n 2 -w 3
        5⤵
        Runs ping.exe
        
        PID:4264
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2896
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:2988
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2364
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:6784
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:4880
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:6744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
      4⤵
      PID:2012
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
        5⤵
        Modifies registry key
        
        PID:2812
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:5852
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:6768
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:7104
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V Csrss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:796
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
  2⤵
  PID:1260
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKLM\Software\MICROSOFT\WINDOWS\CURRENTVERSION\RUN /V smss /t REG_SZ /d "c:\RECYCLER\smss.exe " /f
    3⤵
    - Adds Run key to start application
    - Modifies registry key
    PID:2396

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NJRat.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NJRat.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
PID:7068
- C:\Windows\SysWOW64\netsh.exe
  netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NJRat.exe" "NJRat.exe" ENABLE
  2⤵
  - Modifies Windows Firewall
  PID:2348

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NetWire.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NetWire.exe"
1⤵
PID:5648
- C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NetWire.exe
  "C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\NetWire.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  PID:2828
- - C:\Program Files (x86)\internet explorer\ieinstal.exe
    "C:\Program Files (x86)\internet explorer\ieinstal.exe"
    3⤵
    PID:5420

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E0 0x00000000000004E8
1⤵
PID:5520

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Annabelle.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Annabelle.exe"
1⤵
- Modifies WinLogon for persistence
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Sets file execution options in registry
- Adds Run key to start application
PID:2316
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:6004
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:2596
- C:\Windows\system32\vssadmin.exe
  vssadmin delete shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:3940
- C:\Windows\system32\NetSh.exe
  NetSh Advfirewall set allprofiles state off
  2⤵
  - Modifies Windows Firewall
  PID:6480
- C:\Windows\System32\shutdown.exe
  "C:\Windows\System32\shutdown.exe" -r -t 00 -f
  2⤵
  PID:3124

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Cerber5.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\Cerber5.exe"
1⤵
- Enumerates connected drives
PID:280
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall set allprofiles state on
  2⤵
  - Modifies Windows Firewall
  PID:7136
- C:\Windows\SysWOW64\netsh.exe
  C:\Windows\system32\netsh.exe advfirewall reset
  2⤵
  - Modifies Windows Firewall
  PID:6032
- C:\Windows\SysWOW64\mshta.exe
  "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___UTR0JNM_.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
  2⤵
  PID:5348
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\_R_E_A_D___T_H_I_S___A604_.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1064

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\fdm_x64_setup.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\fdm_x64_setup.exe"
1⤵
PID:6888
- C:\Users\Admin\AppData\Local\Temp\is-39FIL.tmp\fdm_x64_setup.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-39FIL.tmp\fdm_x64_setup.tmp" /SL5="$408D0,42295280,832512,C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\fdm_x64_setup.exe"
  2⤵
  PID:1560

C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe
"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe"
1⤵
PID:3288
- C:\Program Files (x86)\Driver Support One\DSOneWeb.exe
  "C:\Program Files (x86)\Driver Support One\DSOneWeb.exe" -frontUrl:"https://front.driversupport.com" -channel:"gdn_ds1web" -install=true /BOOTSTRAPPERPATH:"C:\Users\Admin\AppData\Local\Temp\Temp2_stuff.zip\DriverUpdate.exe"
  2⤵
  PID:2596

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:952

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa397f055 /state1:0x41c64e6d
1⤵
PID:5376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery