hxxp://pixeldrain[.]com/u/QEeXR3cT

Processes:

MsiExec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,\"C:\\Program Files (x86)\\Def Group\\PC Defender\\Antispyware.exe\""	MsiExec.exe

Windows security bypass 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Checks for common network interception software 1 TTPs
Looks in the registry for tools like Wireshark or Fiddler commonly used to analyze network activity.
evasion

Software Discovery
T1518
Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

InternetSecurityGuard.exe

description ioc process

Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest InternetSecurityGuard.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	InternetSecurityGuard.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	antivirus-platinum.exe

Drops file in Drivers directory 4 IoCs

Processes:

InternetSecurityGuard.exe

description	ioc	process
File created	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\System32\drivers\etc\hosts	InternetSecurityGuard.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	InternetSecurityGuard.exe
File created	C:\Windows\system32\drivers\etc\host_new	InternetSecurityGuard.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

InternetSecurityGuard.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PerAvir.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\winav.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveDefense.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\av360.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\qh.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsTray.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Secure Veteran.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveArmor.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\antivirusxppro2009.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\dop.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SaveKeep.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tsc.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gbn976rl.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PC_Antispyware2010.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsSvc.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsAuxs.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrustWarrior.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ozn695m5.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwarePrj.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartprotector.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\homeav2010.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\personalguard	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntispywarXP2009.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agent.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\~1.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xp_antispyware.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\gav.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smart.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\windll32.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\init32.exe \Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smrtdefp.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\csc.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pctsGui.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rwg.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVCare.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spywarexpguard.exe	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\securitysoldier.exe	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\QuickHealCleaner.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AlphaAV	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Cl.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MalwareRemoval.exe\Debugger = "svchost.exe"	InternetSecurityGuard.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pdfndr.exe	InternetSecurityGuard.exe

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\пездець1488\Шутки\ScreenScrew\ScreenScrew.exe	aspack_v212_v242

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

PCDefender.exeAntivirusPlatinum.exe302746537.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	PCDefender.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	AntivirusPlatinum.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	302746537.exe

Executes dropped EXE 10 IoCs

Processes:

SecurityCentral.exePCDefender.exeSecurityScanner.exeInternetSecurityGuard.exeAntivirus.exeScreenScrew.exeDesktopBoom.exeAntivirusPlatinum.exe302746537.exeantivirus-platinum.exe

pid	process
1412	SecurityCentral.exe
1804	PCDefender.exe
5460	SecurityScanner.exe
5948	InternetSecurityGuard.exe
4764	Antivirus.exe
5996	ScreenScrew.exe
4992	DesktopBoom.exe
5212	AntivirusPlatinum.exe
1472	302746537.exe
3556	antivirus-platinum.exe

Loads dropped DLL 3 IoCs

Processes:

regsvr32.exeregsvr32.exeantivirus-platinum.exe

pid process

3652 regsvr32.exe
5456 regsvr32.exe
3556 antivirus-platinum.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
3652	regsvr32.exe
5456	regsvr32.exe
3556	antivirus-platinum.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\302746537.exe	upx
behavioral1/memory/1472-826-0x0000000000400000-0x0000000000410000-memory.dmp	upx
\??\c:\windows\antivirus-platinum.exe	upx
behavioral1/memory/3556-837-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/1472-841-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/3556-845-0x0000000000400000-0x000000000040D000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

InternetSecurityGuard.exeAntivirus.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\Users\\Admin\\Desktop\\???????1488\\????-??\\InternetSecurityGuard\\InternetSecurityGuard.exe\" /s /d"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	Antivirus.exe

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery
T1518.001

Processes:

InternetSecurityGuard.exe

description ioc process

Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\ InternetSecurityGuard.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	InternetSecurityGuard.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

msiexec.exemsiexec.exeInternetSecurityGuard.exeAntivirus.exe

description	ioc	process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\T:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	Antivirus.exe
File opened (read-only)	\??\V:	Antivirus.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	Antivirus.exe
File opened (read-only)	\??\E:	Antivirus.exe
File opened (read-only)	\??\G:	Antivirus.exe
File opened (read-only)	\??\H:	Antivirus.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	Antivirus.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	InternetSecurityGuard.exe
File opened (read-only)	\??\K:	InternetSecurityGuard.exe
File opened (read-only)	\??\S:	InternetSecurityGuard.exe
File opened (read-only)	\??\M:	Antivirus.exe
File opened (read-only)	\??\N:	Antivirus.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	Antivirus.exe
File opened (read-only)	\??\P:	Antivirus.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	InternetSecurityGuard.exe
File opened (read-only)	\??\Z:	InternetSecurityGuard.exe
File opened (read-only)	\??\Q:	Antivirus.exe
File opened (read-only)	\??\X:	Antivirus.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	InternetSecurityGuard.exe
File opened (read-only)	\??\P:	InternetSecurityGuard.exe
File opened (read-only)	\??\U:	Antivirus.exe
File opened (read-only)	\??\Z:	Antivirus.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\G:	InternetSecurityGuard.exe
File opened (read-only)	\??\J:	Antivirus.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\L:	InternetSecurityGuard.exe
File opened (read-only)	\??\X:	InternetSecurityGuard.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	InternetSecurityGuard.exe
File opened (read-only)	\??\I:	Antivirus.exe
File opened (read-only)	\??\U:	InternetSecurityGuard.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

InternetSecurityGuard.exe

description ioc process

File opened for modification \??\PhysicalDrive0 InternetSecurityGuard.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	InternetSecurityGuard.exe

Drops file in System32 directory 7 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecurityCentral.exe

description pid process

PID 1412 set thread context of 0 1412 SecurityCentral.exe

description	pid	process
PID 1412 set thread context of 0	1412	SecurityCentral.exe

Drops file in Program Files directory 5 IoCs

Processes:

msiexec.exeAntivirus.exe

description	ioc	process
File created	C:\Program Files (x86)\Def Group\PC Defender\proccheck.exe	msiexec.exe
File created	C:\Program Files (x86)\Def Group\PC Defender\Antispyware.exe	msiexec.exe
File created	C:\Program Files (x86)\Def Group\PC Defender\hook.dll	msiexec.exe
File created	C:\Program Files (x86)\AnVi\splash.mp3	Antivirus.exe
File created	C:\Program Files (x86)\AnVi\virus.mp3	Antivirus.exe

Drops file in Windows directory 22 IoCs

Processes:

msiexec.exeAntivirusPlatinum.exeattrib.exe

description	ioc	process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6CDE.tmp	msiexec.exe
File created	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File opened for modification	C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe	msiexec.exe
File created	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File created	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File created	C:\Windows\Installer\e586be4.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_966CD4ED37489844400D0C.exe	msiexec.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240913484	AntivirusPlatinum.exe
File opened for modification	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File opened for modification	C:\Windows\Installer\e586be4.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{FC2ABC8E-3715-4A32-B8B5-559380F45282}	msiexec.exe
File created	C:\Windows\Installer\{FC2ABC8E-3715-4A32-B8B5-559380F45282}\_3F16219B047CF8432B7ADA.exe	msiexec.exe
File created	C:\Windows\Installer\e586be8.msi	msiexec.exe
File opened for modification	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File created	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File opened for modification	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1864 5948 WerFault.exe InternetSecurityGuard.exe

pid	pid_target	process	target process
1864	5948	WerFault.exe	InternetSecurityGuard.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

vssvc.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f9c3b1b881b13bb50000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f9c3b1b80000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed3a000000ffffffff000000000700010000680900f9c3b1b8000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df9c3b1b8000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000f9c3b1b800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 11 IoCs

adware spyware

Modify Registry

Processes:

InternetSecurityGuard.exeantivirus-platinum.exeAntivirus.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\IIL = "0"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\ltTST = "26686"	InternetSecurityGuard.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\PRS = "http://127.0.0.1:27777/?inj=%ORIGINAL%"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\ltHI = "0"	InternetSecurityGuard.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	InternetSecurityGuard.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main	Antivirus.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	Antivirus.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies data under HKEY_USERS 7 IoCs

Processes:

MsiExec.exemsiexec.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings\JITDebug = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2B	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2c	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\2A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\2b	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script\Settings	MsiExec.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exemsiexec.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{612A8625-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83600-895E-11D0-B0A6-000000000000}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C8A3DC00-8593-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E953-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373FF7F1-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\MiscStatus\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94441-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\ = "IImage10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.SBarCtrl\CurVer\ = "COMCTL.SBarCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA42-E020-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D95-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\ = "Microsoft ImageComboBox Control 6.0 (SP4)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE35-8596-11D1-B16A-00C0F0283628}\ = "ImageList General Property Page Object"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B1-850A-101B-AFC0-4210102A8DA7}\ = "IColumnHeader10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Control	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B4-8589-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\C73BCE36FA1AA0E45AB2649A3FA0D390	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5ACBB958-5C57-11CF-8993-00AA00688B10}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E88-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\ProgID\ = "MSComctlLib.TabStrip.2"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.Slider\ = "Microsoft Slider Control 6.0 (SP4)"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\ = "IListItems"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9ED94442-E5E8-101B-B9B5-444553540000}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\InprocServer32\ = "c:\\windows\\comctl32.ocx"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8D2-850A-101B-AFC0-4210102A8DA7}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\E8CBA2CF517323A48B5B5539084F2528\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E8C-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8C-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3F-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "c:\\windows\\mscomctl.ocx"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8624-0FB3-11CE-8747-524153480004}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\Version	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA40-E020-11CF-8E74-00A0C90F26F8}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\ = "IPanel11"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ = "IPanel10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A1-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F4D83604-895E-11D0-B0A6-000000000000}\ = "IColumnHeader"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{373FF7F0-EB8B-11CD-8820-08002B2F4F5A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.ImageComboCtl\CLSID\ = "{DD9DA666-8594-11D1-B16A-00C0F0283628}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{612A8626-0FB3-11CE-8747-524153480004}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A52-E01C-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B0-850A-101B-AFC0-4210102A8DA7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04C-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exemsiexec.exeInternetSecurityGuard.exe

pid	process
3148	msedge.exe
3148	msedge.exe
4424	msedge.exe
4424	msedge.exe
4864	identity_helper.exe
4864	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
5940	msedge.exe
5940	msedge.exe
2356	msiexec.exe
2356	msiexec.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe
5948	InternetSecurityGuard.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

DesktopBoom.exe

pid process

4992 DesktopBoom.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

4424 msedge.exe
4424 msedge.exe
4424 msedge.exe
4424 msedge.exe
4424 msedge.exe
4424 msedge.exe
4424 msedge.exe
4424 msedge.exe

pid	process
4992	DesktopBoom.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

7zFM.exemsiexec.exemsiexec.exevssvc.exe

description	pid	process
Token: SeRestorePrivilege	4516	7zFM.exe
Token: 35	4516	7zFM.exe
Token: SeSecurityPrivilege	4516	7zFM.exe
Token: SeShutdownPrivilege	3572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3572	msiexec.exe
Token: SeSecurityPrivilege	2356	msiexec.exe
Token: SeCreateTokenPrivilege	3572	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3572	msiexec.exe
Token: SeLockMemoryPrivilege	3572	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3572	msiexec.exe
Token: SeMachineAccountPrivilege	3572	msiexec.exe
Token: SeTcbPrivilege	3572	msiexec.exe
Token: SeSecurityPrivilege	3572	msiexec.exe
Token: SeTakeOwnershipPrivilege	3572	msiexec.exe
Token: SeLoadDriverPrivilege	3572	msiexec.exe
Token: SeSystemProfilePrivilege	3572	msiexec.exe
Token: SeSystemtimePrivilege	3572	msiexec.exe
Token: SeProfSingleProcessPrivilege	3572	msiexec.exe
Token: SeIncBasePriorityPrivilege	3572	msiexec.exe
Token: SeCreatePagefilePrivilege	3572	msiexec.exe
Token: SeCreatePermanentPrivilege	3572	msiexec.exe
Token: SeBackupPrivilege	3572	msiexec.exe
Token: SeRestorePrivilege	3572	msiexec.exe
Token: SeShutdownPrivilege	3572	msiexec.exe
Token: SeDebugPrivilege	3572	msiexec.exe
Token: SeAuditPrivilege	3572	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3572	msiexec.exe
Token: SeChangeNotifyPrivilege	3572	msiexec.exe
Token: SeRemoteShutdownPrivilege	3572	msiexec.exe
Token: SeUndockPrivilege	3572	msiexec.exe
Token: SeSyncAgentPrivilege	3572	msiexec.exe
Token: SeEnableDelegationPrivilege	3572	msiexec.exe
Token: SeManageVolumePrivilege	3572	msiexec.exe
Token: SeImpersonatePrivilege	3572	msiexec.exe
Token: SeCreateGlobalPrivilege	3572	msiexec.exe
Token: SeBackupPrivilege	5376	vssvc.exe
Token: SeRestorePrivilege	5376	vssvc.exe
Token: SeAuditPrivilege	5376	vssvc.exe
Token: SeBackupPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe
Token: SeRestorePrivilege	2356	msiexec.exe
Token: SeTakeOwnershipPrivilege	2356	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe

pid	process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe

Suspicious use of SendNotifyMessage 27 IoCs

Processes:

msedge.exeAntivirus.exe

pid	process
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4424	msedge.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe

Suspicious use of SetWindowsHookEx 17 IoCs

Processes:

SecurityCentral.exePCDefender.exeInternetSecurityGuard.exeAntivirus.exeantivirus-platinum.exe

pid	process
1412	SecurityCentral.exe
1804	PCDefender.exe
5948	InternetSecurityGuard.exe
4764	Antivirus.exe
5948	InternetSecurityGuard.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
4764	Antivirus.exe
3556	antivirus-platinum.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 4424 wrote to memory of 4016	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4016	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 4148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 3148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 3148	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe
PID 4424 wrote to memory of 2868	4424	msedge.exe	msedge.exe

System policy modification 1 TTPs 4 IoCs

evasion

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

5588 attrib.exe

pid	process
5588	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pixeldrain.com/u/QEeXR3cT
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb017f46f8,0x7ffb017f4708,0x7ffb017f4718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,251128389659713908,17035557126308373622,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 /prefetch:2
  2⤵
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:400

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\пездець1488 (1).rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4516

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Security Central\SecurityCentral.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Security Central\SecurityCentral.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
PID:1412

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\PC Defender\PCDefender.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\PC Defender\PCDefender.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1804
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\AppData\Local\Temp\RarSFX0\PCDefenderSilentSetup.msi"
  2⤵
  - Enumerates connected drives
  - Suspicious use of AdjustPrivilegeToken
  PID:3572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:3556
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2AD888438666A843335FF9C0B82E2EEC E Global\MSI0000
  2⤵
  - Modifies WinLogon for persistence
  - Modifies data under HKEY_USERS
  PID:5868

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5376

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\SecurityScanner\SecurityScanner.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\SecurityScanner\SecurityScanner.exe"
1⤵
- Executes dropped EXE
PID:5460

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\InternetSecurityGuard\InternetSecurityGuard.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\InternetSecurityGuard\InternetSecurityGuard.exe"
1⤵
- Enumerates VirtualBox registry keys
- Drops file in Drivers directory
- Sets file execution options in registry
- Executes dropped EXE
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5948
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\Desktop\???????1488\????-??\InternetSecurityGuard\11.mof"
  2⤵
  PID:3048
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\Desktop\???????1488\????-??\InternetSecurityGuard\InternetSecurityGuard.exe" "Internet Security Guard" ENABLE
  2⤵
  PID:2472
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5948 -s 2228
  2⤵
  - Program crash
  PID:1864

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus\Antivirus.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus\Antivirus.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4764
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  PID:5216
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop wscsvc
    3⤵
    PID:1692
- C:\Windows\SysWOW64\net.exe
  net stop winmgmt /y
  2⤵
  PID:888
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop winmgmt /y
    3⤵
    PID:3332
- C:\Windows\SysWOW64\net.exe
  net start winmgmt
  2⤵
  PID:5252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start winmgmt
    3⤵
    PID:4156
- C:\Windows\SysWOW64\net.exe
  net start wscsvc
  2⤵
  PID:5880
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 start wscsvc
    3⤵
    PID:844
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
  2⤵
  PID:5704

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5948 -ip 5948
1⤵
PID:4700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Drops file in System32 directory
PID:696
- C:\Windows\system32\wbem\WMIADAP.EXE
  wmiadap.exe /F /T /R
  2⤵
  PID:4472

C:\Users\Admin\Desktop\пездець1488\Шутки\ScreenScrew\ScreenScrew.exe
"C:\Users\Admin\Desktop\пездець1488\Шутки\ScreenScrew\ScreenScrew.exe"
1⤵
- Executes dropped EXE
PID:5996

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x2ec
1⤵
PID:2704

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\23ef62a61f2341e2b14baf11662ff5a7 /t 1848 /p 4764
1⤵
PID:6052

C:\Users\Admin\Desktop\пездець1488\Шутки\DesktopBoom\DesktopBoom.exe
"C:\Users\Admin\Desktop\пездець1488\Шутки\DesktopBoom\DesktopBoom.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:4992

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Platinum\AntivirusPlatinum.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Platinum\AntivirusPlatinum.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Drops file in Windows directory
PID:5212
- C:\WINDOWS\302746537.exe
  "C:\WINDOWS\302746537.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1472
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\D36.tmp\302746537.bat" "
    3⤵
    PID:2564
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\comctl32.ocx
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:3652
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s c:\windows\mscomctl.ocx
      4⤵
      Loads dropped DLL
      Modifies registry class
      PID:5456
  - - \??\c:\windows\antivirus-platinum.exe
      c:\windows\antivirus-platinum.exe
      4⤵
      Windows security bypass
      Disables RegEdit via registry modification
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of SetWindowsHookEx
      System policy modification
      PID:3556
  - - C:\Windows\SysWOW64\attrib.exe
      attrib +h c:\windows\antivirus-platinum.exe
      4⤵
      Drops file in Windows directory
      Views/modifies file attributes
      PID:5588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery