glupteba | hxxps://samples[.]vx-underground[.]org/Samples/VirusSign%20Collection/2024[.]05/Virussign[.]2024[.]05[.]17[.]7z

Processes:

virussign.com_8be37dac0447afc8db8d553c519c5b1b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "Explorer.exe sIRC4.exe"	virussign.com_8be37dac0447afc8db8d553c519c5b1b.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

explorer.exesvchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	svchost.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 5 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

T1497

Processes:

virussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	explorer.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	spoolsv.exe

Modifies Windows Firewall 2 TTPs 1 IoCs
evasion

Windows Service
T1543.003

Disable or Modify System Firewall
T1562.004

Processes:

netsh.exe

pid process

676 netsh.exe

pid	process
676	netsh.exe

Checks BIOS information in registry 2 TTPs 15 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

spoolsv.exespoolsv.exevirussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exesvchost.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	spoolsv.exe

Executes dropped EXE 14 IoCs

Processes:

virussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exespoolsv.exesvchost.exespoolsv.exevirussign.com_0235af7bca7910567869f3866c460fe4.exevirussign.com_18a553ef1d258cebe523621e65c5d61c.exevirussign.com_18a553ef1d258cebe523621e65c5d61c.execsrss.exevirussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exeinjector.exevirussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exevirussign.com_4ed609f1ef9a674c1dcf53a8a5556a61.exevirussign.com_8be37dac0447afc8db8d553c519c5b1b.exe

pid	process
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4336	explorer.exe
2592	spoolsv.exe
1532	svchost.exe
4844	spoolsv.exe
4520	virussign.com_0235af7bca7910567869f3866c460fe4.exe
2356	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
2224	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
5108	csrss.exe
3684	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
1376	injector.exe
2888	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
4508	virussign.com_4ed609f1ef9a674c1dcf53a8a5556a61.exe
3280	virussign.com_8be37dac0447afc8db8d553c519c5b1b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 7 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exeexplorer.exesvchost.exevirussign.com_18a553ef1d258cebe523621e65c5d61c.execsrss.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ati display driver = "ÔN@"	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\resources\\themes\\explorer.exe RO"	svchost.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\resources\\svchost.exe RO"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\""	csrss.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 5 IoCs

evasion trojan

System Information Discovery

Processes:

explorer.exespoolsv.exesvchost.exespoolsv.exevirussign.com_0a31fbd7aee778221d827c4247be3002.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	explorer.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	svchost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	spoolsv.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	virussign.com_0a31fbd7aee778221d827c4247be3002.exe

Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
rootkit evasion

Processes:

csrss.exe

description ioc process

File opened for modification \??\WinMonFS csrss.exe

description	ioc	process
File opened for modification	\??\WinMonFS	csrss.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

spoolsv.exesvchost.exespoolsv.exevirussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	spoolsv.exe
File opened for modification	\??\PhysicalDrive0	svchost.exe
File opened for modification	\??\PhysicalDrive0	spoolsv.exe
File opened for modification	\??\PhysicalDrive0	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
File opened for modification	\??\PhysicalDrive0	explorer.exe

Drops file in System32 directory 64 IoCs

Processes:

virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exevirussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe

description	ioc	process
File created	C:\Windows\SysWOW64\cmmon32.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\eudcedit.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\iexpress.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\mavinject.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\F12\IEChooser.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\lodctr.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\wbem\WmiPrvSE.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\iscsicpl.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\winver.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\ROUTE.EXE-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\CloudNotifications.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\sc.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\where.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\raserver.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\TRACERT.EXE_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\appidtel.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\OneDriveSetup.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\Dism.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\ktmutil.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\Magnify.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\help.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\netiougc.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\sc.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\tracerpt.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\InstallShield\setup.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\unregmp2.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\Com-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\mspaint.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\extrac32.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\attrib.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\cttunesvr.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\ftp.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\cmdl32.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\Robocopy.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\unregmp2.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\InputSwitchToastHandler.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\nslookup.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\TsWpfWrp.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\wbem\WinMgmt.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\diskpart.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\rdrleakdiag.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\iscsicli.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\netiougc.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\CameraSettingsUIHost.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\Com\comrepl.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\ThumbnailExtractionHost.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\xcopy.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\findstr.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\Com	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\fixmapi.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\msdt.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\print.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\stordiag.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\net.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\autochk.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\rasautou.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\ipconfig.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\Netplwiz.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\SystemPropertiesComputerName.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\extrac32.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\srdelayed.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\wecutil.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SysWOW64\appidtel.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SysWOW64\wermgr.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs

Processes:

virussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exespoolsv.exesvchost.exespoolsv.exe

pid process

4452 virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4336 explorer.exe
2592 spoolsv.exe
1532 svchost.exe
4844 spoolsv.exe
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

System Information Discovery
T1082

Processes:

virussign.com_18a553ef1d258cebe523621e65c5d61c.exe

description ioc process

File opened (read-only) \??\VBoxMiniRdrDN virussign.com_18a553ef1d258cebe523621e65c5d61c.exe

description	ioc	process
File opened (read-only)	\??\VBoxMiniRdrDN	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe

Drops file in Program Files directory 64 IoCs

Processes:

virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exevirussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe

description	ioc	process
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Windows Mail\wab.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Music.UI.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeUpdateBroker.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jhat.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\Build.bat	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\Download\{F3C4FE00-EFD5-403B-9569-398A20F1BA4A}\1.3.187.37\MicrosoftEdgeUpdateSetup_X86_1.3.187.37.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Internet Explorer\ExtExport.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\javaws.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe\SpeechToTextOverlay64-Retail.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Internet Explorer\ielowutil.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-006E-0409-1000-0000000FF1CE}\misc.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jdk-1.8\bin\policytool.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\misc.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\pack200.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\Office16\msoasb.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Mozilla Firefox\default-browser-agent.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Java\jre-1.8\bin\javacpl.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Windows Media Player\setup_wm.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Internet Explorer\iexplore.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Java\jre-1.8\bin\kinit.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\outicon.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Mozilla Firefox\plugin-container.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Mozilla Firefox\updater.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.187.37\MicrosoftEdgeComRegisterShellARM64.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files\Java\jre-1.8\bin\jjs.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe

Drops file in Windows directory 64 IoCs

Processes:

virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exevirussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe

description	ioc	process
File created	C:\Windows\WinSxS\amd64_microsoft-windows-g..ation-wincomponents_31bf3856ad364e35_10.0.19041.746_none_79bfc5cb57157e98\r\WindowsActionDialog.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-ngc-trustlet_31bf3856ad364e35_10.0.19041.84_none_dd81fb99bc3b1e53\NgcIso.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-blb-cli-main_31bf3856ad364e35_10.0.19041.264_none_29367e02ede71097\wbadmin.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..management-omadmprc_31bf3856ad364e35_10.0.19041.844_none_93c03ca99a47dc8f\omadmprc.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-u..client-decoder-host_31bf3856ad364e35_10.0.19041.207_none_00b5dbdfab19326f\r\UtcDecoderHost.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-bth-user_31bf3856ad364e35_10.0.19041.1_none_1b0a4d6f748b99f5\fsquirt.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-hyper-v-d..s-vmswitch-netsetup_31bf3856ad364e35_10.0.19041.264_none_62496caeba2daa52\nvspinfo.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_windows-application..egistrationverifier_31bf3856ad364e35_10.0.19041.746_none_64e9b1de23df7cf4\r\AppHostRegistrationVerifier.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-metabase_31bf3856ad364e35_10.0.19041.906_none_1756861d80a1f0f5\inetinfo.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-webauth_31bf3856ad364e35_10.0.19041.746_none_099c40ad55bc5d6c\f\AuthHost.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-o..tiveportal.appxmain_31bf3856ad364e35_10.0.19041.423_none_204af7ff19532470\r\OOBENetworkCaptivePortal.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-settingsynchost_31bf3856ad364e35_10.0.19041.1202_none_f4a35974d85ff180\f\SettingSyncHost.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-snippingtool-app_31bf3856ad364e35_10.0.19041.746_none_77bd4cfbe87238a7\r\SnippingTool.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_e8b8012dee3ba92e\finger.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.746_none_ff52abd5cb47bbe1\r\lpremove.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy\OOBENetworkCaptivePortal.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_eventviewersettings_31bf3856ad364e35_10.0.19041.1_none_aae8e58aa310aa7d\eventvwr.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_1776a3602eb73133\netiougc.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\x86_microsoft-windows-m..s-mdac-odbcconf-exe_31bf3856ad364e35_10.0.19041.1_none_67494c7cd91d4b47\odbcconf.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fsavailux_31bf3856ad364e35_10.0.19041.1_none_60b99066bd2f6d16\fsavailux.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-msinfo32-exe_31bf3856ad364e35_10.0.19041.1110_none_20a89186aedb6af7\msinfo32.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1_none_7999baeaf356e869\mofcomp.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..anagement-dmomacpmo_31bf3856ad364e35_10.0.19041.1_none_856b4f50911c6560\DmOmaCpMo.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-s..spaces-spacemanager_31bf3856ad364e35_10.0.19041.1266_none_bee3df875f7e71bb\r\spaceman.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-container-manager_31bf3856ad364e35_10.0.19041.1266_none_07a5d18b92d8b668\r\cmdiag.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-w..ter-cimprovider-exe_31bf3856ad364e35_10.0.19041.1_none_193aab8d8b539746\Register-CimProvider.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-defrag-adminui_31bf3856ad364e35_10.0.19041.84_none_9b0dd648f2c31f16\dfrgui.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.19041.964_none_510ebdd9292eed06\diskpart.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.1_none_c3249fe181844dfb\MsSpellCheckingHost.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_multipoint-wmssessionagent_31bf3856ad364e35_10.0.19041.746_none_7f157730d01dcdae\WmsSessionAgent.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-iis-legacysnapin_31bf3856ad364e35_10.0.19041.906_none_5f45625010b4cd19\InetMgr6.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.19041.1081_none_2e31e8eed4b770c3\WMIADAP.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-i..llshield-wow64-main_31bf3856ad364e35_10.0.19041.1081_none_e34aea343fc255b7\setup.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-fileexplorer.appxmain_31bf3856ad364e35_10.0.19041.546_none_476476bb5c3a0bbc\FileExplorer.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.AppRep.ChxApp_cw5n1h2txyewy\CHXSmartScreen.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-powershell-exe_31bf3856ad364e35_10.0.19041.546_none_470f45b46101edfb\powershell.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-tcpip_31bf3856ad364e35_10.0.19041.1_none_1776a3602eb73133\netiougc.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_0f750b10a0559386\IMTCPROP.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.5\MSBuild.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\SystemApps\Microsoft.Windows.XGpuEjectDialog_cw5n1h2txyewy\XGpuEjectDialog.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\winhlp32.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-lsa-minwin_31bf3856ad364e35_10.0.19041.1266_none_b2317523477fbd48\r\lsass.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-pktmon-setup_31bf3856ad364e35_10.0.19041.928_none_31fd477afc7b8278\f\PktMon.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-tools-nltest_31bf3856ad364e35_10.0.19041.1151_none_0f2f3a9cb1826509\nltest.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-onecore-u..iedwritefilter-mgmt_31bf3856ad364e35_10.0.19041.1266_none_41843efc8f66bc7c\uwfmgr.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-cipher_31bf3856ad364e35_10.0.19041.1_none_63078cde447629b6\cipher.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.19041.746_none_db09942beaf4fdfa\r\Microsoft.ECApp.exe_	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-speechcommon-onecore_31bf3856ad364e35_10.0.19041.1081_none_e836fc4ed2e2ecc1\r\SpeechModelDownload.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core-providerhost_31bf3856ad364e35_10.0.19041.546_none_ee5c058bea34543e\WmiPrvSE.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\wow64_microsoft-windows-runonce_31bf3856ad364e35_10.0.19041.1202_none_94cfabd8a89f0b96\f\runonce.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-securitycenter-core_31bf3856ad364e35_10.0.19041.1081_none_8f1e438c6737a711\r\wscadminui.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\AddInProcess.exe	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Resources\spoolsv.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_8fc08423f52c1606\wmlaunch.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-security-spp-ux-dlg_31bf3856ad364e35_10.0.19041.1_none_544850fb795d0a4f\UpgradeResultsUI.exe-	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_8f7cfa81649ea7a8\esentutl.exe-	virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-d..d-searchintegration_31bf3856ad364e35_10.0.19041.746_none_63b0fc68ee30f2cb\r\IMESEARCH.EXE_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
File created	C:\Windows\WinSxS\amd64_microsoft-windows-office-csp_31bf3856ad364e35_10.0.19041.844_none_9b62a70f9278f2cd\r\ofdeploy.exe_	virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

pid process

4380 powershell.exe
4444 powershell.exe
1236 powershell.exe
2888 powershell.exe
3336 powershell.exe
3680 powershell.exe
2992 powershell.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1652 4520 WerFault.exe virussign.com_0235af7bca7910567869f3866c460fe4.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

5088 schtasks.exe
1380 schtasks.exe

pid	process
4380	powershell.exe
4444	powershell.exe
1236	powershell.exe
2888	powershell.exe
3336	powershell.exe
3680	powershell.exe
2992	powershell.exe

pid	pid_target	process	target process
1652	4520	WerFault.exe	virussign.com_0235af7bca7910567869f3866c460fe4.exe

pid	process
5088	schtasks.exe
1380	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 46 IoCs

adware spyware

Modify Registry

Processes:

IEXPLORE.exeIEXPLORE.exeIEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c837400000000020000000000106600000001000020000000bfe069af556674c6947e508269c9ea2b6dd6477891a4270a8621b3de597ceec9000000000e8000000002000020000000ed3a97d5b58e4e4edb440bed2047ee4db8a939a32f64eacb6be395d3a58487192000000024c325898bf27bd62e6ae0bd9b370d53d94c02e702ecda2bb810bab35f391e7f40000000e7c03d63d7f6b3ec08665039ec11e9ce58f5f25e3eaef1394d6a433f6949cb2be3758b29dbfec39f822c0e573f2c22839d829ce5eab91fd305ef9622de7f5c10	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{6C3B47C7-1858-11EF-A084-5A63B3EA338B} = "0"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b06f414265acda01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c837400000000020000000000106600000001000020000000c0d2ddb1440e181b1d7e9070098402a5c0cde433c147be36f7d7fd33585f0798000000000e8000000002000020000000713814604445466b0db6e8bf0c5a3808eef1c48a23cff29cd9256eeac44ddc3a200000000c08a292cd6905f4687d47c03a49200e445366291d8fae8767cacc8e9b0b645440000000c703b525b1a8775cd47f0152b365d7542b07bf04328263a173ac8fabe1163347f2a64a44bfd6c29479da57983ac8a2b1398f760a86834168cd6d033871a8bea6	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31108197"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31108197"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1083894650"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000006633b135c95c54191e4d28dd78c837400000000020000000000106600000001000020000000cd8d10a0bc53a1c4561eed91915a2966d4ea45686b588bc863bd2c7b01447e85000000000e8000000002000020000000e774e79034fc10a5b34b2255972604f45131e00295a6f7e963ee1fa63ee2fd442000000046c44dd849b58042dfc67f356b399a2d295258266211a868e2192e413f5cb64440000000691e58b1e1a6337690602261f442d962321bd39dfc272741e735152803229a502a1a7f7b9c9668330b70959b78bcf710fd3449aa8181f41f505e18b896295ccc	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = b01c3a4265acda01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 900cf44465acda01	IEXPLORE.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1083894650"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{7EC8578C-1858-11EF-A084-5A63B3EA338B} = "0"	IEXPLORE.exe
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	IEXPLORE.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

virussign.com_18a553ef1d258cebe523621e65c5d61c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2061 = "North Korea Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-112 = "Eastern Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-981 = "Kamchatka Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-382 = "South Africa Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-449 = "Azerbaijan Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-832 = "SA Eastern Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2871 = "Magallanes Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-384 = "Namibia Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-791 = "SA Western Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-541 = "Myanmar Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-461 = "Afghanistan Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-141 = "Canada Central Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-52 = "Greenland Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-281 = "Central Europe Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-351 = "FLE Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-542 = "Myanmar Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2941 = "Sao Tome Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-511 = "Central Asia Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-831 = "SA Eastern Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1021 = "Bangladesh Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2872 = "Magallanes Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-871 = "Pakistan Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-2842 = "Saratov Standard Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a\52C64B7E\C:\Windows\system32\,@tzres.dll,-1501 = "Turkey Daylight Time"	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings msedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exevirussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exe

pid	process
1284	msedge.exe
1284	msedge.exe
4264	msedge.exe
4264	msedge.exe
1068	identity_helper.exe
1068	identity_helper.exe
2416	msedge.exe
2416	msedge.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

7zFM.exeexplorer.exesvchost.exe

pid process

4828 7zFM.exe
4336 explorer.exe
1532 svchost.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

Processes:

msedge.exe

pid process

4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe
4264 msedge.exe

pid	process
4828	7zFM.exe
4336	explorer.exe
1532	svchost.exe

Suspicious use of AdjustPrivilegeToken 21 IoCs

Processes:

7zFM.exepowershell.exevirussign.com_18a553ef1d258cebe523621e65c5d61c.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exe

description	pid	process
Token: SeRestorePrivilege	4828	7zFM.exe
Token: 35	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeDebugPrivilege	3680	powershell.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeDebugPrivilege	2356	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Token: SeImpersonatePrivilege	2356	virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
Token: SeDebugPrivilege	2992	powershell.exe
Token: SeDebugPrivilege	4380	powershell.exe
Token: SeDebugPrivilege	4444	powershell.exe
Token: SeDebugPrivilege	1236	powershell.exe
Token: SeDebugPrivilege	2888	powershell.exe
Token: SeDebugPrivilege	3336	powershell.exe
Token: SeSystemEnvironmentPrivilege	5108	csrss.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe
Token: SeSecurityPrivilege	4828	7zFM.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe
4264	msedge.exe

Suspicious use of SetWindowsHookEx 25 IoCs

Processes:

virussign.com_0a31fbd7aee778221d827c4247be3002.exeexplorer.exespoolsv.exesvchost.exespoolsv.exevirussign.com_0235af7bca7910567869f3866c460fe4.exeIEXPLORE.exeIEXPLORE.EXEIEXPLORE.exeIEXPLORE.EXE

pid	process
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4452	virussign.com_0a31fbd7aee778221d827c4247be3002.exe
4336	explorer.exe
4336	explorer.exe
4336	explorer.exe
2592	spoolsv.exe
2592	spoolsv.exe
2592	spoolsv.exe
1532	svchost.exe
1532	svchost.exe
1532	svchost.exe
4844	spoolsv.exe
4844	spoolsv.exe
4844	spoolsv.exe
4520	virussign.com_0235af7bca7910567869f3866c460fe4.exe
4520	virussign.com_0235af7bca7910567869f3866c460fe4.exe
60	IEXPLORE.exe
60	IEXPLORE.exe
2780	IEXPLORE.EXE
2780	IEXPLORE.EXE
1324	IEXPLORE.exe
1324	IEXPLORE.exe
5004	IEXPLORE.EXE
5004	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4264 wrote to memory of 228	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 228	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4316	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 1284	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 1284	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe
PID 4264 wrote to memory of 4020	4264	msedge.exe	msedge.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://samples.vx-underground.org/Samples/VirusSign%20Collection/2024.05/Virussign.2024.05.17.7z
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff85d2746f8,0x7ff85d274708,0x7ff85d274718
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2128,9695521878577849696,15647778139683925862,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2768

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Virussign.2024.05.17.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Users\Admin\Desktop\virussign.com_0a31fbd7aee778221d827c4247be3002.exe
"C:\Users\Admin\Desktop\virussign.com_0a31fbd7aee778221d827c4247be3002.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4452
- \??\c:\windows\resources\themes\explorer.exe
  c:\windows\resources\themes\explorer.exe
  2⤵
  - Modifies visiblity of hidden/system files in Explorer
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks whether UAC is enabled
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:4336
- - \??\c:\windows\resources\spoolsv.exe
    c:\windows\resources\spoolsv.exe SE
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Checks BIOS information in registry
    - Executes dropped EXE
    - Checks whether UAC is enabled
    - Writes to the Master Boot Record (MBR)
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - \??\c:\windows\resources\svchost.exe
      c:\windows\resources\svchost.exe
      4⤵
      Modifies visiblity of hidden/system files in Explorer
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Checks BIOS information in registry
      Executes dropped EXE
      Adds Run key to start application
      Checks whether UAC is enabled
      Writes to the Master Boot Record (MBR)
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - \??\c:\windows\resources\spoolsv.exe
        
        c:\windows\resources\spoolsv.exe PR
        5⤵
        Identifies VirtualBox via ACPI registry values (likely anti-VM)
        Checks BIOS information in registry
        Executes dropped EXE
        Checks whether UAC is enabled
        Writes to the Master Boot Record (MBR)
        Suspicious use of NtSetInformationThreadHideFromDebugger
        Suspicious use of SetWindowsHookEx
        
        PID:4844

C:\Users\Admin\Desktop\virussign.com_0235af7bca7910567869f3866c460fe4.exe
"C:\Users\Admin\Desktop\virussign.com_0235af7bca7910567869f3866c460fe4.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4520
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4520 -s 760
  2⤵
  - Program crash
  PID:1652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4520 -ip 4520
1⤵
PID:2156

C:\Users\Admin\Desktop\virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
"C:\Users\Admin\Desktop\virussign.com_18a553ef1d258cebe523621e65c5d61c.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2356
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -nologo -noprofile
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3680
- C:\Users\Admin\Desktop\virussign.com_18a553ef1d258cebe523621e65c5d61c.exe
  "C:\Users\Admin\Desktop\virussign.com_18a553ef1d258cebe523621e65c5d61c.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Checks for VirtualBox DLLs, possible anti-VM trick
  - Modifies data under HKEY_USERS
  PID:2224
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:2992
- - C:\Windows\system32\cmd.exe
    C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
    3⤵
    PID:3356
  - - C:\Windows\system32\netsh.exe
      netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
      4⤵
      Modifies Windows Firewall
      PID:676
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:4380
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noprofile
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Modifies data under HKEY_USERS
    - Suspicious use of AdjustPrivilegeToken
    PID:4444
- - C:\Windows\rss\csrss.exe
    C:\Windows\rss\csrss.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Manipulates WinMonFS driver.
    - Suspicious use of AdjustPrivilegeToken
    PID:5108
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:1236
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:1380
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /delete /tn ScheduledUpdate /f
      4⤵
      PID:4532
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:2888
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -nologo -noprofile
      4⤵
      Command and Scripting Interpreter: PowerShell
      Modifies data under HKEY_USERS
      Suspicious use of AdjustPrivilegeToken
      PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe
      C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll
      4⤵
      Executes dropped EXE
      PID:1376
  - - C:\Windows\SYSTEM32\schtasks.exe
      schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
      4⤵
      Creates scheduled task(s)
      PID:5088

C:\Users\Admin\Desktop\virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe
"C:\Users\Admin\Desktop\virussign.com_252b38cda7c4334e3c3e8ec58cc65e1b.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:3684
- C:\Program Files\Internet Explorer\IEXPLORE.exe
  "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:60
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:60 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:2780

C:\Users\Admin\Desktop\virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe
"C:\Users\Admin\Desktop\virussign.com_546d717c3d23bd4f9cfd981ffafb7f5d.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
PID:2888
- C:\Program Files\Internet Explorer\IEXPLORE.exe
  "C:\Program Files\Internet Explorer\IEXPLORE" 212.33.237.86/images/1/report.php
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1324
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1324 CREDAT:17410 /prefetch:2
    3⤵
    - Modifies Internet Explorer settings
    - Suspicious use of SetWindowsHookEx
    PID:5004

C:\Users\Admin\Desktop\virussign.com_4ed609f1ef9a674c1dcf53a8a5556a61.exe
"C:\Users\Admin\Desktop\virussign.com_4ed609f1ef9a674c1dcf53a8a5556a61.exe"
1⤵
- Executes dropped EXE
PID:4508

C:\Users\Admin\Desktop\virussign.com_8be37dac0447afc8db8d553c519c5b1b.exe
"C:\Users\Admin\Desktop\virussign.com_8be37dac0447afc8db8d553c519c5b1b.exe"
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
PID:3280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery