6a1c7dc0e02359b3211bda7dd68995016bd47ef439c2a760083ccadc064bd783

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Modifies Installed Components in the registry 2 TTPs 20 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "Guest"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	Explorer.EXE

Drops startup file 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

Drops desktop.ini file(s) 52 IoCs

Processes:

regsvr32.exeregsvr32.exeWinMail.exeregsvr32.exemctadmin.exeie4uinit.exeExplorer.EXEWinMail.exe

description	ioc	process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-501\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File created	C:\Users\Guest\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Favorites\Links for United States\desktop.ini	mctadmin.exe
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Guest\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3452737119-3959686427-228443150-501\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Pictures\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

unregmp2.exeunregmp2.exe

description	ioc	process
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Control Panel\Desktop\Wallpaper = "C:\\Users\\Guest\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Control Panel\Desktop\Wallpaper = "C:\\Users\\Guest\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 1 IoCs

Processes:

ie4uinit.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe

Drops file in Windows directory 5 IoCs

Processes:

ie4uinit.exerundll32.exechrmstp.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	chrmstp.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Explorer.EXE

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

Explorer.EXErunonce.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

System Information Discovery

Processes:

csrss.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\Pattern Upgrade = "TRUE"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Appearance\Schemes	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop	rundll32.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

Processes:

ie4uinit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

ie4uinit.exemctadmin.exeregsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\UseClearType = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\XMLHTTP = "1"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = f0eb6ea256adda01	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\6	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Toolbar	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\16\IEPropFontName = "Vani"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\29\IEPropFontName = "Plantagenet Cherokee"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\8	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\10\IEFixedFontName = "Mangal"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Euphemia"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\35\IEFixedFontName = "Estrangelo Edessa"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Save_Session_History_On_Exit = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Show_ToolBar = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\12	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\39\IEFixedFontName = "Mongolian Baiti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\SOFTWARE\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\LowRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\7\IEPropFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\9\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\16\IEFixedFontName = "Vani"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\25\IEPropFontName = "PMingLiu"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\36	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	mctadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Search Page = "http://go.microsoft.com/fwlink/?LinkId=54896"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Desktop	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\4\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\19	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\21	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\37\IEFixedFontName = "Khmer UI"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\39\IEPropFontName = "Mongolian Baiti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\4	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\9	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\12\IEFixedFontName = "Raavi"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\17\IEFixedFontName = "Tunga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\31	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Show_FullURL = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\7	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\26\IEPropFontName = "Simsun"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\33	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\3	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\18	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\22	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Document Windows\x = 00000080	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\39	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\International\Scripts\9\IEFixedFontName = "Courier New"	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

Processes:

ie4uinit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 9 IoCs

Processes:

winlogon.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe

Modifies registry class 64 IoCs

Processes:

unregmp2.exeExplorer.EXEunregmp2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4a\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\ShellEx\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wvx\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-wav	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.AudioCD\Shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wma	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mpg	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wm	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/vnd.dlna.mpeg-tts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.tts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AudioCD	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\ShellEx\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2ts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mp4	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-501_CLASSES\Local Settings\MuiCache	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2ts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mid\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wms	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/vnd.dlna.adts	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp2\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.MTS\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\OpenWithProgIds	unregmp2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Explorer.EXE

pid process

1488 Explorer.EXE

Suspicious use of AdjustPrivilegeToken 40 IoCs

Processes:

LogonUI.exewinlogon.exeWinMail.exeie4uinit.exerundll32.exeWinMail.exeExplorer.EXE

description	pid	process
Token: SeShutdownPrivilege	1424	LogonUI.exe
Token: SeSecurityPrivilege	792	winlogon.exe
Token: SeBackupPrivilege	792	winlogon.exe
Token: SeSecurityPrivilege	792	winlogon.exe
Token: SeTcbPrivilege	792	winlogon.exe
Token: SeManageVolumePrivilege	1308	WinMail.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	1020	ie4uinit.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeRestorePrivilege	2468	rundll32.exe
Token: SeManageVolumePrivilege	2936	WinMail.exe
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE
Token: SeShutdownPrivilege	1488	Explorer.EXE

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

Explorer.EXE

pid	process
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE

Suspicious use of SendNotifyMessage 26 IoCs

Processes:

Explorer.EXE

pid	process
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE
1488	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

WinMail.exeWinMail.exe

pid process

1308 WinMail.exe
2936 WinMail.exe

pid	process
1308	WinMail.exe
2936	WinMail.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

csrss.exewinlogon.exeuserinit.exeExplorer.EXEWinMail.exe

description	pid	process	target process
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 792 wrote to memory of 1424	792	winlogon.exe	LogonUI.exe
PID 792 wrote to memory of 1424	792	winlogon.exe	LogonUI.exe
PID 792 wrote to memory of 1424	792	winlogon.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 1424	536	csrss.exe	LogonUI.exe
PID 536 wrote to memory of 2776	536	csrss.exe	userinit.exe
PID 536 wrote to memory of 2776	536	csrss.exe	userinit.exe
PID 792 wrote to memory of 2776	792	winlogon.exe	userinit.exe
PID 792 wrote to memory of 2776	792	winlogon.exe	userinit.exe
PID 792 wrote to memory of 2776	792	winlogon.exe	userinit.exe
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 2776 wrote to memory of 1488	2776	userinit.exe	Explorer.EXE
PID 2776 wrote to memory of 1488	2776	userinit.exe	Explorer.EXE
PID 2776 wrote to memory of 1488	2776	userinit.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 1488	536	csrss.exe	Explorer.EXE
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 1488 wrote to memory of 344	1488	Explorer.EXE	regsvr32.exe
PID 1488 wrote to memory of 344	1488	Explorer.EXE	regsvr32.exe
PID 1488 wrote to memory of 344	1488	Explorer.EXE	regsvr32.exe
PID 1488 wrote to memory of 344	1488	Explorer.EXE	regsvr32.exe
PID 1488 wrote to memory of 344	1488	Explorer.EXE	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 2208	536	csrss.exe	rundll32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 344	536	csrss.exe	regsvr32.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 1488 wrote to memory of 2000	1488	Explorer.EXE	WinMail.exe
PID 1488 wrote to memory of 2000	1488	Explorer.EXE	WinMail.exe
PID 1488 wrote to memory of 2000	1488	Explorer.EXE	WinMail.exe
PID 1488 wrote to memory of 2000	1488	Explorer.EXE	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 2000	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 1308	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 1308	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 1308	536	csrss.exe	WinMail.exe
PID 536 wrote to memory of 1308	536	csrss.exe	WinMail.exe
PID 2000 wrote to memory of 1308	2000	WinMail.exe	WinMail.exe
PID 2000 wrote to memory of 1308	2000	WinMail.exe	WinMail.exe
PID 2000 wrote to memory of 1308	2000	WinMail.exe	WinMail.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js
1⤵
PID:2096

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2476

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" shell32.dll,Control_RunDLL desk.cpl,Web,0
1⤵
- Modifies Control Panel
PID:2436

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:2896

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,Control_RunDLL C:\Windows\System32\main.cpl ,1
1⤵
PID:2140

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:776

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:536

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:792

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2776

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
3⤵
- Modifies visibility of file extensions in Explorer
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
4⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:344

C:\Program Files (x86)\Windows Mail\WinMail.exe
"C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
4⤵
- Drops desktop.ini file(s)
- Suspicious use of WriteProcessMemory
PID:2000

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
5⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1308

C:\Windows\System32\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
4⤵
- Enumerates connected drives
- Modifies registry class
PID:3060

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2740

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
4⤵
PID:628

C:\Windows\System32\ie4uinit.exe
"C:\Windows\System32\ie4uinit.exe" -UserConfig
4⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
PID:1020

C:\Windows\System32\ie4uinit.exe
C:\Windows\System32\ie4uinit.exe -ClearIconCache
5⤵
PID:1272

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
5⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
5⤵
PID:2524

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
6⤵
PID:2112

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
4⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:2452

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2936

C:\Windows\System32\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
4⤵
- Enumerates connected drives
- Modifies registry class
PID:2868

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2744

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
4⤵
PID:2428

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
4⤵
PID:320

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x140167688,0x140167698,0x1401676a8
5⤵
PID:1568

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
5⤵
- Drops file in Windows directory
PID:2232

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x140167688,0x140167698,0x1401676a8
6⤵
PID:1428

C:\Windows\System32\ickr0a.exe
"C:\Windows\System32\ickr0a.exe"
4⤵
PID:1784

C:\Program Files\Windows Sidebar\sidebar.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
4⤵
PID:2360

C:\Windows\SysWOW64\runonce.exe
C:\Windows\SysWOW64\runonce.exe /Run6432
4⤵
- Checks processor information in registry
PID:2316

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
5⤵
PID:2288

C:\Windows\System32\mctadmin.exe
"C:\Windows\System32\mctadmin.exe"
4⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
PID:2564

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:900

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:2208

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery