a00f705b4a5d0d0a21700b0c95198e0fa51c06e6670cfe559b259a23e072fb63

Processes:

wscript.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Creates new service(s) 1 TTPs
persistence

Windows Service
T1543.003
Downloads MZ/PE file

Drops file in Drivers directory 4 IoCs

Processes:

SecurityService.exeSecurityService.exe

description	ioc	process
File created	C:\Windows\system32\drivers\webshieldfilter.sys	SecurityService.exe
File created	C:\Windows\system32\drivers\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\system32\drivers\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\system32\drivers\protected_elam.sys	SecurityService.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1547.001

Modify Registry
T1112
Possible privilege escalation attempt 3 IoCs
exploit

Processes:

icacls.exetakeown.exetakeown.exe

pid process

7924 icacls.exe
6052 takeown.exe
8180 takeown.exe

pid	process
7924	icacls.exe
6052	takeown.exe
8180	takeown.exe

Sets file execution options in registry 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

SecurityService.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	SecurityService.exe

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsc7E16.tmp\nsRandom.dll	acprotect

Deletes itself 1 IoCs

Processes:

SecurityService.exe

pid process

7608 SecurityService.exe

pid	process
7608	SecurityService.exe

Drops startup file 1 IoCs

Processes:

SecurityService.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gadiuispsal.lnk	SecurityService.exe

Executes dropped EXE 14 IoCs

Processes:

TotalAV_Setup.exeSecurityService.exeTotalAV.exeSecurityService.exeSecurityService.exeavupdate.exeavupdate.exeapc_random_id_generator.exeavupdate.exeTotalAV.exeeulascr.exesvchost.exetaskhost.exesvchost.exe

pid	process
416	TotalAV_Setup.exe
1936	SecurityService.exe
5660	TotalAV.exe
10912	SecurityService.exe
7608	SecurityService.exe
1260	avupdate.exe
4264	avupdate.exe
9052	apc_random_id_generator.exe
1068	avupdate.exe
12660	TotalAV.exe
8024	eulascr.exe
17676	svchost.exe
16732	taskhost.exe
9868	svchost.exe

Loads dropped DLL 64 IoCs

Processes:

TotalAV_Setup.exeSecurityService.exe

pid	process
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
416	TotalAV_Setup.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe
1936	SecurityService.exe

Modifies file permissions 1 TTPs 3 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exetakeown.exetakeown.exe

pid process

7924 icacls.exe
6052 takeown.exe
8180 takeown.exe

pid	process
7924	icacls.exe
6052	takeown.exe
8180	takeown.exe

Modifies system executable filetype association 2 TTPs 5 IoCs

Modify Registry

Change Default File Association

T1546.001

Processes:

SecurityService.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

Processes:

resource	yara_rule
behavioral1/memory/8024-10481-0x0000000000D20000-0x0000000000D4A000-memory.dmp	agile_net

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 2 IoCs

Registry Run Keys / Startup Folder

Processes:

TotalAV.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" -ToastActivated"	TotalAV.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32	TotalAV.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\nsc7E16.tmp\nsRandom.dll	upx
behavioral1/memory/13784-44080-0x0000000000400000-0x0000000000454000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\DB.EXE	upx
C:\Users\Admin\AppData\Local\Temp\EN.EXE	upx
behavioral1/memory/11556-47038-0x0000000000400000-0x000000000040A000-memory.dmp	upx
behavioral1/memory/8632-47036-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/8632-47037-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/8632-47034-0x0000000000770000-0x0000000000803000-memory.dmp	upx
behavioral1/memory/8632-46976-0x0000000000400000-0x0000000000445000-memory.dmp	upx
behavioral1/memory/11556-47631-0x0000000000400000-0x000000000040A000-memory.dmp	upx

Adds Run key to start application 2 TTPs 5 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

Whiter.a.exeSecurityService.exeSevgi.a.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Whistler = "C:\\Windows\\system32\\whismng.exe -next"	Whiter.a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000\Software\Microsoft\Windows\CurrentVersion\Run\	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Netagent = "c:\\windows\\system\\sysfile.exe"	Sevgi.a.exe

Checks for any installed AV software in registry 1 TTPs 7 IoCs

Security Software Discovery

T1518.001

Processes:

SecurityService.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Wow64_32Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_USERS\S-1-5-21-1856190483-1022094809-400023910-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_LOCAL_MACHINE\Software\Wow64_32Node\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus\Overwrite_Keys\HKEY_USERS\S-1-5-21-1856190483-1022094809-400023910-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit	SecurityService.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 5 IoCs

Processes:

Whiter.a.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Documents\desktop.ini	Whiter.a.exe
File opened for modification	\??\f:\$RECYCLE.BIN\S-1-5-21-1856190483-1022094809-400023910-1000\desktop.ini	Whiter.a.exe
File opened for modification	\??\c:\$Recycle.Bin\S-1-5-21-1856190483-1022094809-400023910-1000\desktop.ini	Whiter.a.exe
File opened for modification	\??\c:\Program Files\desktop.ini	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	Whiter.a.exe

Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

takeown.exetakeown.exe

description ioc process

File opened (read-only) \??\V: takeown.exe
File opened (read-only) \??\V: takeown.exe
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs

Web Service
T1102

Processes:

flow ioc

15 camo.githubusercontent.com

description	ioc	process
File opened (read-only)	\??\V:	takeown.exe
File opened (read-only)	\??\V:	takeown.exe

flow	ioc
15	camo.githubusercontent.com

Drops file in System32 directory 32 IoCs

Processes:

SecurityService.exeSecurityService.exeWhiter.a.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	SecurityService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_wqsxzqrojlfbwj3xmqn5vi2gsla5q5aq\oxrldkb5.tmp	SecurityService.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\SecurityService\SecurityService_Url_wqsxzqrojlfbwj3xmqn5vi2gsla5q5aq\oxrldkb5.newcfg	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\ok	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\whismng.exe	Whiter.a.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\Web\Host	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\2ce9748a-523a-49e1-8062-a989b6d9e99c\Logs.db-journal	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV\vdf_1714503134.zip	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\sync	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\Mysa	SecurityService.exe
File created	C:\Windows\SysWOW64\whismng.exe:Zone.Identifier:$DATA	Whiter.a.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8890A77645B73478F5B1DED18ACBF795_C090A8C88B266C6FF99A97210E92B44D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DA3B6E45325D5FFF28CF6BAD6065C907_72F8BE6966E415D8C7AFC6FE31E2A14D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\2ce9748a-523a-49e1-8062-a989b6d9e99c\Logs.db-journal	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DA3B6E45325D5FFF28CF6BAD6065C907_72F8BE6966E415D8C7AFC6FE31E2A14D	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\System Core	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\win defender run	SecurityService.exe
File opened for modification	C:\Windows\System32\Tasks\oka	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\2ce9748a-523a-49e1-8062-a989b6d9e99c\Logs.db	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\AppCenter\2ce9748a-523a-49e1-8062-a989b6d9e99c\Logs.db	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	SecurityService.exe
File created	C:\Windows\SysWOW64\whismng.exe	Whiter.a.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\TotalAV\vdf_1714503134.zip	SecurityService.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	SecurityService.exe

Drops file in Program Files directory 64 IoCs

Processes:

Whiter.a.exeSecurityService.exeTotalAV_Setup.exe

description	ioc	process
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\PREVIEW.GIF	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-nynt4chb.tmp	SecurityService.exe
File created	\??\c:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\AccessVL_KMS_Client-ppd.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-ppd.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_Subscription2-pl.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SONORA\SONORA.INF	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\on_access\win64\win8\avipbb.inf	TotalAV_Setup.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Globalization.Calendars.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Templates\1033\ApothecaryLetter.dotx	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\Savapi.Net.dll	TotalAV_Setup.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-a13qj3fj.tmp	SecurityService.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-4nasb31o.tmp	SecurityService.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Retail-pl.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019DemoR_BypassTrial180-ul-oob.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-140.png	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-zgyl1ngj.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00218.vdf	SecurityService.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Windows.Extensions.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-pl.xrm-ms	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-rz2zrkdh.tmp	SecurityService.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.ComponentModel.Primitives.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\Fonts\private\JUICE___.TTF	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest1-ppd.xrm-ms	Whiter.a.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00244.vdf	SecurityService.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Trial2-ul-oob.xrm-ms	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-mqy0mihe.tmp	SecurityService.exe
File opened for modification	C:\Program Files (x86)\TotalAV\SAVAPI\xbv00249.vdf	SecurityService.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\jli.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365EduCloudEDUR_SubTrial-pl.xrm-ms	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\plg_fops_dummy.dll	TotalAV_Setup.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\api-ms-win-crt-conio-l1-1-0.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\System.Windows.Controls.Ribbon.resources.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\7-Zip\Lang\io.txt	Whiter.a.exe
File created	\??\c:\Program Files\Common Files\System\msadc\it-IT\msadcor.dll.mui	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_Subscription-pl.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\StandardVL_KMS_Client-ppd.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.PowerPivot.ExcelAddIn.dll	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\on_access\win64\win7\avipbb.cat	TotalAV_Setup.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.2\ReachFramework.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-00E2-0409-1000-0000000FF1CE.xml	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\System.Xml.XPath.XmlDocument.dll	TotalAV_Setup.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Runtime.Extensions.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ValueTuple.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\MSWORD.OLB	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\System.Security.AccessControl.dll	TotalAV_Setup.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\UIAutomationClientSideProviders.resources.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\bin\plugin2\npjp2.dll	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription1-ul-oob.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-math-l1-1-0.dll	Whiter.a.exe
File created	\??\c:\Program Files\Common Files\microsoft shared\ink\de-DE\rtscom.dll.mui	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\SOLVER32.DLL	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.contrast-white_scale-100.png	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Java\jdk-1.8\jre\lib\psfont.properties.ja	Whiter.a.exe
File opened for modification	\??\c:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms	Whiter.a.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\ReachFramework.resources.dll	Whiter.a.exe
File created	C:\Program Files (x86)\TotalAV\SAVAPI\DotNetZip-osyeifh4.tmp	SecurityService.exe
File opened for modification	\??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\System.Console.dll	Whiter.a.exe

Drops file in Windows directory 14 IoCs

Processes:

SecurityService.exeZika.exeSecurityService.exe

description	ioc	process
File opened for modification	C:\Windows\Tasks\System Core	SecurityService.exe
File opened for modification	C:\Windows\Tasks\Mysa	SecurityService.exe
File opened for modification	C:\Windows\Tasks\ok	SecurityService.exe
File opened for modification	C:\Windows\Help\lsmosee.exe	SecurityService.exe
File created	C:\Windows\notepad.dll.sys.exe	Zika.exe
File created	C:\Windows\ELAMBKUP\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\Tasks\win defender run	SecurityService.exe
File opened for modification	C:\Windows\Help\lsmose.exe	SecurityService.exe
File opened for modification	C:\Windows\debug\lsmose.exe	SecurityService.exe
File opened for modification	C:\Windows\debug\lsmosee.exe	SecurityService.exe
File created	C:\Windows\ELAMBKUP\protected_elam.sys	SecurityService.exe
File opened for modification	C:\Windows\Tasks\Web\Host	SecurityService.exe
File opened for modification	C:\Windows\Tasks\oka	SecurityService.exe
File opened for modification	C:\Windows\notepad.dll.sys.exe	Zika.exe

Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.

Processes:

sc.exe

pid process

1780 sc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

704 1936 WerFault.exe

pid	process
1780	sc.exe

pid	pid_target	process	target process
704	1936	WerFault.exe

NSIS installer 2 IoCs

installer

Processes:

resource	yara_rule
C:\Users\Admin\Downloads\TotalAV_Setup.exe	nsis_installer_1
C:\Users\Admin\Downloads\TotalAV_Setup.exe	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 13 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exevds.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\AttributesTableCache = a2a0d0ebe5b9334487c068b6b72699c70000000000000000	vds.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vds.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d6da5b3da49a91300000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d6da5b3d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900d6da5b3d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd6da5b3d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000d6da5b3d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 12 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.

System Information Discovery
T1082

Command and Scripting Interpreter
T1059

Processes:

ipconfig.exe

pid process

14700 ipconfig.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

17208 taskkill.exe
1544 taskkill.exe
4876 taskkill.exe
2988 taskkill.exe

pid	process
14700	ipconfig.exe

pid	process
17208	taskkill.exe
1544	taskkill.exe
4876	taskkill.exe
2988	taskkill.exe

Modifies data under HKEY_USERS 51 IoCs

Processes:

SecurityService.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	SecurityService.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	SecurityService.exe

Modifies registry class 55 IoCs

Processes:

TotalAV.exeSecurityService.exeSecurityService.exemsedge.exemsedge.exefirefox.exeOpenWith.exeOpenWith.exeOpenWith.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID	TotalAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-folders=\"%1\" --hide"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" \"%1\""	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\{E4BA4655-58DA-474C-969A-6C45ED9B3AC3}	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\command	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\URL Protocol	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\DefaultIcon	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}	TotalAV.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\SeparatorBefore	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32	TotalAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node	TotalAV.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\WOW6432Node\CLSID\{d79b57ed-727c-4ab8-ba67-e7c6fd30fac1}\LocalServer32\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" -ToastActivated"	TotalAV.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\SeparatorBefore	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\SeparatorBefore	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\MultiSelectModel = "Single"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\Position = "Top"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\ = "URL:Total AV Protocol"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\Position = "Top"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\DefaultIcon\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open\command	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htafile\Shell\Open\Command\ = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1856190483-1022094809-400023910-1000\{3E9F978C-5217-4740-AAC4-E432D8E8DABC}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\SeparatorAfter	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\ = "Scan With TotalAV"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-files=\"%1\" --hide"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shell\TotalAV\command	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\totalav\shell\open	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\command\ = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\" --custom-scan-context --custom-scan-archives --custom-scan-folders=\"%1\" --hide"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\{E4BA4655-58DA-474C-969A-6C45ED9B3AC3}\telemetry = "cab008ca78eb445ab703a322130e98e8cc48a182"	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shell\TotalAV\Icon = "\"C:\\Program Files (x86)\\TotalAV\\TotalAV.exe\""	SecurityService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shell\TotalAV\command	SecurityService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	SecurityService.exe
Key created	\REGISTRY\USER\S-1-5-21-1856190483-1022094809-400023910-1000_Classes\Local Settings	OpenWith.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

SecurityService.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	SecurityService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd67707390b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b660537f000000010000000e000000300c060a2b0601040182370a03047e000000010000000800000000c001b39667d60168000000010000000800000000409120d035d901030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	SecurityService.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1368000000010000000800000000409120d035d9017e000000010000000800000000c001b39667d6017f000000010000000e000000300c060a2b0601040182370a03041d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589100b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000006200000001000000200000000687260331a72403d909f105e69bcf0d32e1bd2493ffc6d9206d11bcd6770739090000000100000042000000304006082b06010505070302060a2b0601040182370a030c060a2b0601040182370a030406082b0601050507030406082b0601050507030106082b060105050703080f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	SecurityService.exe

NTFS ADS 7 IoCs

Processes:

msedge.exemsedge.exeZika.exemsedge.exemsedge.exemsedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\trojan-master.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier	msedge.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.exe\:Zone.Identifier:$DATA	Zika.exe
File created	C:\Program Files\Microsoft Office\root\Office16\excelcnv.dll.sys.exe\:Zone.Identifier:$DATA	Zika.exe
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 746292.crdownload:SmartScreen	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\TotalAV_Setup.exe:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\trojan-1.16.0-linux-amd64.tar.xz:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeTotalAV.exeSecurityService.exemsedge.exeSecurityService.exemsedge.exe

pid	process
760	msedge.exe
760	msedge.exe
4320	msedge.exe
4320	msedge.exe
1520	msedge.exe
1520	msedge.exe
4880	identity_helper.exe
4880	identity_helper.exe
1620	msedge.exe
1620	msedge.exe
1976	msedge.exe
1976	msedge.exe
5660	TotalAV.exe
5660	TotalAV.exe
5660	TotalAV.exe
5660	TotalAV.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
10912	SecurityService.exe
10912	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
11460	msedge.exe
11460	msedge.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe
7608	SecurityService.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

OpenWith.exeOpenWith.exeSevgi.a.exe

pid process

12632 OpenWith.exe
11280 OpenWith.exe
6396 Sevgi.a.exe
Suspicious behavior: LoadsDriver 1 IoCs

Processes:

pid process

672

pid	process
12632	OpenWith.exe
11280	OpenWith.exe
6396	Sevgi.a.exe

pid	process
672

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 41 IoCs

Processes:

msedge.exe

pid	process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

wmic.exetaskkill.exetaskkill.exetaskkill.exevssvc.exesrtasks.exeSecurityService.exeTotalAV.exeSecurityService.exeSecurityService.exe

description	pid	process
Token: SeIncreaseQuotaPrivilege	3696	wmic.exe
Token: SeSecurityPrivilege	3696	wmic.exe
Token: SeTakeOwnershipPrivilege	3696	wmic.exe
Token: SeLoadDriverPrivilege	3696	wmic.exe
Token: SeSystemProfilePrivilege	3696	wmic.exe
Token: SeSystemtimePrivilege	3696	wmic.exe
Token: SeProfSingleProcessPrivilege	3696	wmic.exe
Token: SeIncBasePriorityPrivilege	3696	wmic.exe
Token: SeCreatePagefilePrivilege	3696	wmic.exe
Token: SeBackupPrivilege	3696	wmic.exe
Token: SeRestorePrivilege	3696	wmic.exe
Token: SeShutdownPrivilege	3696	wmic.exe
Token: SeDebugPrivilege	3696	wmic.exe
Token: SeSystemEnvironmentPrivilege	3696	wmic.exe
Token: SeRemoteShutdownPrivilege	3696	wmic.exe
Token: SeUndockPrivilege	3696	wmic.exe
Token: SeManageVolumePrivilege	3696	wmic.exe
Token: 33	3696	wmic.exe
Token: 34	3696	wmic.exe
Token: 35	3696	wmic.exe
Token: 36	3696	wmic.exe
Token: SeIncreaseQuotaPrivilege	3696	wmic.exe
Token: SeSecurityPrivilege	3696	wmic.exe
Token: SeTakeOwnershipPrivilege	3696	wmic.exe
Token: SeLoadDriverPrivilege	3696	wmic.exe
Token: SeSystemProfilePrivilege	3696	wmic.exe
Token: SeSystemtimePrivilege	3696	wmic.exe
Token: SeProfSingleProcessPrivilege	3696	wmic.exe
Token: SeIncBasePriorityPrivilege	3696	wmic.exe
Token: SeCreatePagefilePrivilege	3696	wmic.exe
Token: SeBackupPrivilege	3696	wmic.exe
Token: SeRestorePrivilege	3696	wmic.exe
Token: SeShutdownPrivilege	3696	wmic.exe
Token: SeDebugPrivilege	3696	wmic.exe
Token: SeSystemEnvironmentPrivilege	3696	wmic.exe
Token: SeRemoteShutdownPrivilege	3696	wmic.exe
Token: SeUndockPrivilege	3696	wmic.exe
Token: SeManageVolumePrivilege	3696	wmic.exe
Token: 33	3696	wmic.exe
Token: 34	3696	wmic.exe
Token: 35	3696	wmic.exe
Token: 36	3696	wmic.exe
Token: SeDebugPrivilege	1544	taskkill.exe
Token: SeDebugPrivilege	4876	taskkill.exe
Token: SeDebugPrivilege	2988	taskkill.exe
Token: SeBackupPrivilege	1976	vssvc.exe
Token: SeRestorePrivilege	1976	vssvc.exe
Token: SeAuditPrivilege	1976	vssvc.exe
Token: SeBackupPrivilege	3592	srtasks.exe
Token: SeRestorePrivilege	3592	srtasks.exe
Token: SeSecurityPrivilege	3592	srtasks.exe
Token: SeTakeOwnershipPrivilege	3592	srtasks.exe
Token: SeDebugPrivilege	1936	SecurityService.exe
Token: SeDebugPrivilege	5660	TotalAV.exe
Token: SeBackupPrivilege	3592	srtasks.exe
Token: SeRestorePrivilege	3592	srtasks.exe
Token: SeSecurityPrivilege	3592	srtasks.exe
Token: SeTakeOwnershipPrivilege	3592	srtasks.exe
Token: SeDebugPrivilege	10912	SecurityService.exe
Token: SeDebugPrivilege	7608	SecurityService.exe
Token: SeAssignPrimaryTokenPrivilege	7608	SecurityService.exe
Token: SeIncreaseQuotaPrivilege	7608	SecurityService.exe
Token: SeSecurityPrivilege	7608	SecurityService.exe
Token: SeTakeOwnershipPrivilege	7608	SecurityService.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe

Suspicious use of SendNotifyMessage 21 IoCs

Processes:

msedge.exeTotalAV.exe

pid	process
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
5660	TotalAV.exe
5660	TotalAV.exe
5660	TotalAV.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
4320	msedge.exe
5660	TotalAV.exe
5660	TotalAV.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

TotalAV_Setup.exeSecurityService.exeTotalAV.exeOpenWith.exeOpenWith.exefirefox.exeOpenWith.exeMrsMajor3.0.exeOpenWith.exejavaw.exesvchost.exetaskhost.exesvchost.exe

pid	process
416	TotalAV_Setup.exe
1936	SecurityService.exe
5660	TotalAV.exe
5660	TotalAV.exe
11680	OpenWith.exe
12632	OpenWith.exe
10744	firefox.exe
11280	OpenWith.exe
7680	MrsMajor3.0.exe
6128	OpenWith.exe
4496	javaw.exe
4496	javaw.exe
4496	javaw.exe
4496	javaw.exe
17676	svchost.exe
16732	taskhost.exe
9868	svchost.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4320 wrote to memory of 4780	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4780	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 4604	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 760	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 760	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe
PID 4320 wrote to memory of 3664	4320	msedge.exe	msedge.exe

System policy modification 1 TTPs 3 IoCs

evasion

Modify Registry

Processes:

SecurityService.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shell = "explorer.exe"	SecurityService.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3928 attrib.exe

pid	process
3928	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4320

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd90ef3cb8,0x7ffd90ef3cc8,0x7ffd90ef3cd8
2⤵
PID:4780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
2⤵
PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
2⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
2⤵
PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3892 /prefetch:1
2⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
2⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
2⤵
PID:3780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
2⤵
PID:1116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
2⤵
PID:3048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5856 /prefetch:8
2⤵
PID:3308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5968 /prefetch:8
2⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
2⤵
PID:4856

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3464 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4880

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
2⤵
PID:1168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
2⤵
PID:1680

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
2⤵
PID:2100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
2⤵
PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
2⤵
PID:3100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
2⤵
PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2652 /prefetch:1
2⤵
PID:4904

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6940 /prefetch:1
2⤵
PID:2720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=7108 /prefetch:8
2⤵
PID:3720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
2⤵
PID:1728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1976

C:\Users\Admin\Downloads\TotalAV_Setup.exe
"C:\Users\Admin\Downloads\TotalAV_Setup.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:416

C:\Windows\SysWOW64\Wbem\wmic.exe
wmic.exe path Win32_Process where executablepath="C:\\Program Files (x86)\\TotalAV\\TotalAV.exe" delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3696

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /f /T /IM "avupdate.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1544

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /f /T /IM "Update.Win.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SysWOW64\taskkill.exe
"taskkill" /f /T /IM "PasswordExtension.Win.exe"
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2988

C:\Program Files (x86)\TotalAV\SecurityService.exe
"C:\Program Files (x86)\TotalAV\SecurityService.exe" "--install"
3⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1936

C:\Windows\SysWOW64\sc.exe
"sc" create SecurityService start= auto binpath= "\"C:\Program Files (x86)\TotalAV\SecurityService.exe\"" displayname= "PC Security Management Service" obj= LocalSystem password= ""
4⤵
- Launches sc.exe
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 4468
4⤵
- Program crash
PID:704

C:\Program Files (x86)\TotalAV\TotalAV.exe
"C:\Program Files (x86)\TotalAV\TotalAV.exe" --installed --installer="C:\Users\Admin\Downloads\TotalAV_Setup.exe"
3⤵
- Executes dropped EXE
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.totalav.com/video?logintoken=NWEwN2UxYjAyNDcyNDU0MTkxZDY3NDcxNWE5OTllMDBfMTcxNDUwMzEzMkBwcm90ZWN0ZWQtc2lnbnVwLmNvbTowZGYwMmU2YzMwOGRmMTAzYzQ5NzhjNjI2OWMzNGRhZjExMjgzNjVjOjJjMWMxNTdhNTdiODNhY2ZiNGZjMWQ3ZGNiZTQzNzM4NWJkYjMwMGY1NjYwNTUxM2Y1YTBiOGY0YjU3ZWVmM2E6ODMyNzA5NDY%3D&source=WIN_GUIV2_CREATED_ACCOUNT&action=NONE&sourceGroup=win-app
4⤵
PID:6524

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd90ef3cb8,0x7ffd90ef3cc8,0x7ffd90ef3cd8
5⤵
PID:11536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.totalav.com/?logintoken=NWEwN2UxYjAyNDcyNDU0MTkxZDY3NDcxNWE5OTllMDBfMTcxNDUwMzEzMkBwcm90ZWN0ZWQtc2lnbnVwLmNvbTowZGYwMmU2YzMwOGRmMTAzYzQ5NzhjNjI2OWMzNGRhZjExMjgzNjVjOjJjMWMxNTdhNTdiODNhY2ZiNGZjMWQ3ZGNiZTQzNzM4NWJkYjMwMGY1NjYwNTUxM2Y1YTBiOGY0YjU3ZWVmM2E6ODMyNzA5NDY%3D&source=WIN_GUIV2_FREE_EDITION_POST_SMART_SCAN_LIGHTBOX&action=NONE&sourceGroup=win-app
4⤵
PID:8056

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd90ef3cb8,0x7ffd90ef3cc8,0x7ffd90ef3cd8
5⤵
PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://secure.totalav.com/?logintoken=NWEwN2UxYjAyNDcyNDU0MTkxZDY3NDcxNWE5OTllMDBfMTcxNDUwMzEzMkBwcm90ZWN0ZWQtc2lnbnVwLmNvbTowZGYwMmU2YzMwOGRmMTAzYzQ5NzhjNjI2OWMzNGRhZjExMjgzNjVjOjJjMWMxNTdhNTdiODNhY2ZiNGZjMWQ3ZGNiZTQzNzM4NWJkYjMwMGY1NjYwNTUxM2Y1YTBiOGY0YjU3ZWVmM2E6ODMyNzA5NDY%3D&source=WIN_GUIV2_FREE_EDITION_JUNK_CLEANED_GRACE_PERIOD_AUTO_LAUNCH&action=NONE&sourceGroup=win-app&junk-files=194&junk-bytes=566245647
4⤵
PID:1896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd90ef3cb8,0x7ffd90ef3cc8,0x7ffd90ef3cd8
5⤵
PID:8276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4760 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5948

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
2⤵
PID:6564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
2⤵
PID:9300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7544 /prefetch:1
2⤵
PID:10308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
2⤵
PID:11448

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7888 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:11460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7568 /prefetch:1
2⤵
PID:7728

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7464 /prefetch:1
2⤵
PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
2⤵
PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:1
2⤵
PID:12752

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3300 /prefetch:8
2⤵
- NTFS ADS
PID:12764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
2⤵
PID:11804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6820 /prefetch:1
2⤵
PID:13028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7188 /prefetch:1
2⤵
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:1
2⤵
PID:8500

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8440 /prefetch:1
2⤵
PID:7108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8628 /prefetch:8
2⤵
PID:8296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7948 /prefetch:8
2⤵
PID:9244

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8728 /prefetch:8
2⤵
PID:9284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=7992 /prefetch:8
2⤵
PID:10476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8640 /prefetch:1
2⤵
PID:4268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
2⤵
PID:12428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7876 /prefetch:1
2⤵
PID:8988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
2⤵
PID:8944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9140 /prefetch:1
2⤵
PID:10264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8232 /prefetch:1
2⤵
PID:7488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
2⤵
PID:2132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8372 /prefetch:1
2⤵
PID:1692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9156 /prefetch:1
2⤵
PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8704 /prefetch:8
2⤵
PID:9592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8376 /prefetch:8
2⤵
PID:11048

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=9280 /prefetch:8
2⤵
PID:11288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=8952 /prefetch:8
2⤵
PID:716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=9284 /prefetch:8
2⤵
- NTFS ADS
PID:10428

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1724,15946664069768353911,7780967009563006071,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7204 /prefetch:1
2⤵
PID:10332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1936 -ip 1936
1⤵
PID:2812

C:\Program Files (x86)\TotalAV\SecurityService.exe
"C:\Program Files (x86)\TotalAV\SecurityService.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:10912

C:\Program Files (x86)\TotalAV\SecurityService.exe
"C:\Program Files (x86)\TotalAV\SecurityService.exe" --run-service --run-service-id=10912
2⤵
- Drops file in Drivers directory
- Sets file execution options in registry
- Deletes itself
- Drops startup file
- Executes dropped EXE
- Modifies system executable filetype association
- Adds Run key to start application
- Checks for any installed AV software in registry
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:7608

C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
"C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
3⤵
- Executes dropped EXE
PID:1260

C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
"C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
3⤵
- Executes dropped EXE
PID:4264

C:\Program Files (x86)\TotalAV\SAVAPI\apc_random_id_generator.exe
"C:\Program Files (x86)\TotalAV\SAVAPI\apc_random_id_generator.exe"
3⤵
- Executes dropped EXE
PID:9052

C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe
"C:\Program Files (x86)\TotalAV\Savapi\avupdate.exe" --config=avupdate-savapilib-engine.conf --check-product --no-dns-resolve --internet-srvs=https://definition.protected.net --peak-handling-srvs=https://definition.protected.net
3⤵
- Executes dropped EXE
PID:1068

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:11680

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:8996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004C0 0x00000000000004CC
1⤵
PID:3592

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:12632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:10708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:10744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1952 -parentBuildID 20240401114208 -prefsHandle 1868 -prefMapHandle 1860 -prefsLen 25459 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {832100b3-ceb5-414e-bc2a-bbbc44c0e8b4} 10744 "\\.\pipe\gecko-crash-server-pipe.10744" gpu
3⤵
PID:11060

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2348 -parentBuildID 20240401114208 -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 25495 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {affb962e-10bb-4f50-9754-189cbb08475f} 10744 "\\.\pipe\gecko-crash-server-pipe.10744" socket
3⤵
- Checks processor information in registry
PID:11112

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3340 -childID 1 -isForBrowser -prefsHandle 3332 -prefMapHandle 3328 -prefsLen 25636 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56d4ac40-c9a4-4ff7-8085-c87f96c7906c} 10744 "\\.\pipe\gecko-crash-server-pipe.10744" tab
3⤵
PID:6044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3668 -childID 2 -isForBrowser -prefsHandle 3288 -prefMapHandle 2740 -prefsLen 30869 -prefMapSize 244658 -jsInitHandle 1400 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63a6c940-83eb-4371-8e40-73c8f42f5635} 10744 "\\.\pipe\gecko-crash-server-pipe.10744" tab
3⤵
PID:7144

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4268 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4868 -prefMapHandle 4864 -prefsLen 30869 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c964670-9a96-4d06-85c3-5c284003a4fa} 10744 "\\.\pipe\gecko-crash-server-pipe.10744" utility
3⤵
- Checks processor information in registry
PID:12300

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:11280

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Joke\ScreenScrew.exe"
1⤵
PID:11284

C:\Program Files (x86)\TotalAV\TotalAV.exe
"C:\Program Files (x86)\TotalAV\TotalAV.exe"
1⤵
- Executes dropped EXE
PID:12660

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\MrsMajors\MrsMajor3.0.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:7680

C:\Windows\system32\wscript.exe
"C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\8997.tmp\8998.tmp\8999.vbs //Nologo
2⤵
- UAC bypass
- System policy modification
PID:5616

C:\Users\Admin\AppData\Local\Temp\8997.tmp\eulascr.exe
"C:\Users\Admin\AppData\Local\Temp\8997.tmp\eulascr.exe"
3⤵
- Executes dropped EXE
PID:8024

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6128

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Nostart.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Nostart.exe"
1⤵
PID:12792

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Offiz.js"
1⤵
PID:8336

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\PCToaster.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\PCToaster.exe"
1⤵
PID:12536

C:\Program Files\Java\jre-1.8\bin\javaw.exe
"C:\Program Files\Java\jre-1.8\bin\javaw.exe" -jar "C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\PCToaster.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:4496

C:\Windows\system32\icacls.exe
C:\Windows\system32\icacls.exe C:\ProgramData\Oracle\Java\.oracle_jre_usage /grant "everyone":(OI)(CI)M
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:7924

C:\Windows\SYSTEM32\attrib.exe
attrib +h C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\scr.txt
3⤵
- Views/modifies file attributes
PID:3928

C:\Windows\SYSTEM32\diskpart.exe
diskpart /s C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\scr.txt
3⤵
PID:3948

C:\Windows\SYSTEM32\takeown.exe
takeown /f V:\Boot /r
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:6052

C:\Windows\SYSTEM32\takeown.exe
takeown /f V:\Recovery /r
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Enumerates connected drives
PID:8180

C:\Windows\SYSTEM32\taskkill.exe
taskkill /im lsass.exe /f
3⤵
- Kills process with taskkill
PID:17208

C:\Windows\SYSTEM32\mountvol.exe
mountvol A: /d
3⤵
PID:15916

C:\Windows\SYSTEM32\mountvol.exe
mountvol B: /d
3⤵
PID:17780

C:\Windows\SYSTEM32\mountvol.exe
mountvol D: /d
3⤵
PID:8292

C:\Windows\SYSTEM32\mountvol.exe
mountvol E: /d
3⤵
PID:12056

C:\Windows\SYSTEM32\mountvol.exe
mountvol F: /d
3⤵
PID:6100

C:\Windows\SYSTEM32\mountvol.exe
mountvol G: /d
3⤵
PID:8368

C:\Windows\SYSTEM32\mountvol.exe
mountvol H: /d
3⤵
PID:11640

C:\Windows\SYSTEM32\mountvol.exe
mountvol I: /d
3⤵
PID:14184

C:\Windows\SYSTEM32\mountvol.exe
mountvol J: /d
3⤵
PID:8108

C:\Windows\SYSTEM32\mountvol.exe
mountvol K: /d
3⤵
PID:17704

C:\Windows\SYSTEM32\mountvol.exe
mountvol L: /d
3⤵
PID:9232

C:\Windows\SYSTEM32\mountvol.exe
mountvol M: /d
3⤵
PID:14756

C:\Windows\SYSTEM32\mountvol.exe
mountvol N: /d
3⤵
PID:10644

C:\Windows\SYSTEM32\mountvol.exe
mountvol O: /d
3⤵
PID:2244

C:\Windows\SYSTEM32\mountvol.exe
mountvol P: /d
3⤵
PID:11940

C:\Windows\SYSTEM32\mountvol.exe
mountvol W: /d
3⤵
PID:9056

C:\Windows\SYSTEM32\mountvol.exe
mountvol V: /d
3⤵
PID:15024

C:\Windows\SYSTEM32\mountvol.exe
mountvol U: /d
3⤵
PID:9468

C:\Windows\SYSTEM32\mountvol.exe
mountvol T: /d
3⤵
PID:7620

C:\Windows\SYSTEM32\mountvol.exe
mountvol S: /d
3⤵
PID:5540

C:\Windows\SYSTEM32\mountvol.exe
mountvol R: /d
3⤵
PID:6376

C:\Windows\SYSTEM32\mountvol.exe
mountvol Q: /d
3⤵
PID:3376

C:\Windows\SYSTEM32\mountvol.exe
mountvol X: /d
3⤵
PID:8096

C:\Windows\SYSTEM32\mountvol.exe
mountvol Y: /d
3⤵
PID:8520

C:\Windows\SYSTEM32\mountvol.exe
mountvol Z: /d
3⤵
PID:4008

C:\Windows\SYSTEM32\mountvol.exe
mountvol C: /d
3⤵
PID:16312

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:5644

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:9772

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Sevgi.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Sevgi.a.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
PID:6396

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Whiter.a.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Whiter.a.exe"
1⤵
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
PID:13004

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Zika.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Zika.exe"
1⤵
- Drops file in Windows directory
- NTFS ADS
PID:17340

C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\svchost.exe" -extract C:\Program Files\Microsoft Office\root\Office16\excelcnv.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.rc, icongroup,,
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:17676

C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\taskhost.exe
"C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.rc, C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.res
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:16732

C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\svchost.exe
"C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\svchost.exe" -extract C:\Program Files\Microsoft Office\root\Office16\excelcnv.dll.sys.exe, C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.rc, icongroup,,
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:9868

C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\taskhost.exe
"C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\taskhost.exe" -compile C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.rc, C:\Users\Admin\AppData\Local\Temp\de2b9a4268594aecb18c74dd9081391e\icons.res
2⤵
PID:13692

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
PID:14408

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\ArcticBomb.exe"
1⤵
PID:13784

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Ana.exe"
1⤵
PID:9988

C:\Users\Admin\AppData\Local\Temp\AV.EXE
"C:\Users\Admin\AppData\Local\Temp\AV.EXE"
2⤵
PID:12808

C:\Users\Admin\AppData\Roaming\RtlDriver32.exe
"C:\Users\Admin\AppData\Roaming\RtlDriver32.exe"
3⤵
PID:5740

C:\Users\Admin\AppData\Local\Temp\AV2.EXE
"C:\Users\Admin\AppData\Local\Temp\AV2.EXE"
2⤵
PID:1788

C:\Users\Admin\AppData\Local\Temp\DB.EXE
"C:\Users\Admin\AppData\Local\Temp\DB.EXE"
2⤵
PID:8632

C:\Windows\SysWOW64\Windows8.exe
C:\Windows\SysWOW64\Windows8.exe
3⤵
PID:13476

C:\Windows\SysWOW64\ipconfig.exe
"C:\Windows\system32\ipconfig.exe" /flushdns
4⤵
- Gathers network information
PID:14700

C:\Windows\SysWOW64\cmd.exe
/c C:\Users\Admin\AppData\Local\Temp\~unins93.bat "C:\Users\Admin\AppData\Local\Temp\DB.EXE"
3⤵
PID:14980

C:\Users\Admin\AppData\Local\Temp\EN.EXE
"C:\Users\Admin\AppData\Local\Temp\EN.EXE"
2⤵
PID:11556

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\EN.EXE > nul
3⤵
PID:14084

C:\Users\Admin\AppData\Local\Temp\SB.EXE
"C:\Users\Admin\AppData\Local\Temp\SB.EXE"
2⤵
PID:4276

C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe
"C:\Users\Admin\Downloads\The-MALWARE-Repo-master\The-MALWARE-Repo-master\Trojan\Alerta.exe"
1⤵
PID:16120

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Create or Modify System Process

T1543

Windows Service

T1543.003

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

File and Directory Permissions Modification

T1222

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Software Discovery

T1518

Security Software Discovery

T1518.001

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery