hxxp://pixeldrain[.]com/u/QEeXR3cT

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
ransomware evasion

Inhibit System Recovery
T1490

Processes:

bcdedit.exebcdedit.exe

pid process

2604 bcdedit.exe
2600 bcdedit.exe

pid	process
2604	bcdedit.exe
2600	bcdedit.exe

Disables RegEdit via registry modification 1 IoCs

evasion

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	antivirus-platinum.exe

Disables Task Manager via registry modification
evasion

Executes dropped EXE 15 IoCs

Processes:

Koteyka2.exeAntivirusPlatinum.exe302746537.exeantivirus-platinum.exeAntivirusPro2017.exeSecurityScanner.exeYouAreAnIdiot.exeXyeta.exeFreeYoutubeDownloader.exeHydra.exeWin7Recovery.exeWbVhxCIDDK.exeFreeYoutubeDownloader.exeMEMZ.exeSpark.exe

pid	process
932	Koteyka2.exe
4160	AntivirusPlatinum.exe
936	302746537.exe
3380	antivirus-platinum.exe
3740	AntivirusPro2017.exe
2968	SecurityScanner.exe
4024	YouAreAnIdiot.exe
3696	Xyeta.exe
944	FreeYoutubeDownloader.exe
3480	Hydra.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4000	FreeYoutubeDownloader.exe
4572	MEMZ.exe
1424	Spark.exe

Loads dropped DLL 6 IoCs

Processes:

regsvr32.exeregsvr32.exeantivirus-platinum.exeYouAreAnIdiot.exeSpark.exe

pid process

720 regsvr32.exe
4316 regsvr32.exe
3380 antivirus-platinum.exe
4024 YouAreAnIdiot.exe
4024 YouAreAnIdiot.exe
1424 Spark.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
720	regsvr32.exe
4316	regsvr32.exe
3380	antivirus-platinum.exe
4024	YouAreAnIdiot.exe
4024	YouAreAnIdiot.exe
1424	Spark.exe

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Windows\302746537.exe	upx
behavioral1/memory/936-352-0x0000000000400000-0x0000000000410000-memory.dmp	upx
C:\Windows\antivirus-platinum.exe	upx
behavioral1/memory/3380-365-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/936-370-0x0000000000400000-0x0000000000410000-memory.dmp	upx
behavioral1/memory/3380-375-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/3380-380-0x0000000000400000-0x000000000040D000-memory.dmp	upx
behavioral1/memory/3380-382-0x0000000000400000-0x000000000040D000-memory.dmp	upx
C:\Users\Admin\Desktop\пездець1488\Рансомы\Xyeta\Xyeta.exe	upx
behavioral1/memory/3696-433-0x0000000000400000-0x000000000044F000-memory.dmp	upx
behavioral1/memory/3696-434-0x0000000000400000-0x000000000044F000-memory.dmp	upx

Windows security modification 2 TTPs 3 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	antivirus-platinum.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

AntivirusPro2017.exeWin7Recovery.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\Desktop\\???????1488\\????-??\\Antivirus Pro 2017\\AntivirusPro2017.exe"	AntivirusPro2017.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\WbVhxCIDDK = "C:\\ProgramData\\WbVhxCIDDK.exe"	Win7Recovery.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

AntivirusPro2017.exe

description	ioc	process
File opened (read-only)	\??\K:	AntivirusPro2017.exe
File opened (read-only)	\??\P:	AntivirusPro2017.exe
File opened (read-only)	\??\X:	AntivirusPro2017.exe
File opened (read-only)	\??\E:	AntivirusPro2017.exe
File opened (read-only)	\??\G:	AntivirusPro2017.exe
File opened (read-only)	\??\J:	AntivirusPro2017.exe
File opened (read-only)	\??\R:	AntivirusPro2017.exe
File opened (read-only)	\??\S:	AntivirusPro2017.exe
File opened (read-only)	\??\W:	AntivirusPro2017.exe
File opened (read-only)	\??\Y:	AntivirusPro2017.exe
File opened (read-only)	\??\I:	AntivirusPro2017.exe
File opened (read-only)	\??\L:	AntivirusPro2017.exe
File opened (read-only)	\??\Q:	AntivirusPro2017.exe
File opened (read-only)	\??\O:	AntivirusPro2017.exe
File opened (read-only)	\??\T:	AntivirusPro2017.exe
File opened (read-only)	\??\U:	AntivirusPro2017.exe
File opened (read-only)	\??\V:	AntivirusPro2017.exe
File opened (read-only)	\??\Z:	AntivirusPro2017.exe
File opened (read-only)	\??\H:	AntivirusPro2017.exe
File opened (read-only)	\??\M:	AntivirusPro2017.exe
File opened (read-only)	\??\N:	AntivirusPro2017.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

AntivirusPro2017.exe

description ioc process

File opened for modification \??\PhysicalDrive0 AntivirusPro2017.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	AntivirusPro2017.exe

Drops file in Windows directory 16 IoCs

Processes:

Spark.exeAntivirusPlatinum.exeattrib.exe

description	ioc	process
File created	C:\Windows\File Cache\Spark.exe	Spark.exe
File created	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File created	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\MSCOMCTL.OCX	AntivirusPlatinum.exe
File opened for modification	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File opened for modification	C:\windows\antivirus-platinum.exe	attrib.exe
File created	C:\Windows\File Cache\IFEO.exe	Spark.exe
File opened for modification	C:\Windows\File Cache\Spark.exe	Spark.exe
File created	C:\Windows\File Cache\Initialised	Spark.exe
File created	C:\Windows\__tmp_rar_sfx_access_check_240709484	AntivirusPlatinum.exe
File created	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File created	C:\Windows\302746537.exe	AntivirusPlatinum.exe
File created	C:\Windows\File Cache\Driver.sys	Spark.exe
File opened for modification	C:\Windows\antivirus-platinum.exe	AntivirusPlatinum.exe
File opened for modification	C:\Windows\COMCTL32.OCX	AntivirusPlatinum.exe
File created	C:\Windows\File Cache\DLL.dll	Spark.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 13 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3152	4024	WerFault.exe	YouAreAnIdiot.exe
5024	3696	WerFault.exe	Xyeta.exe
2496	2348	WerFault.exe	Win7Recovery.exe
3652	2348	WerFault.exe	Win7Recovery.exe
2104	2348	WerFault.exe	Win7Recovery.exe
1884	2348	WerFault.exe	Win7Recovery.exe
2056	2348	WerFault.exe	Win7Recovery.exe
3436	2348	WerFault.exe	Win7Recovery.exe
1504	2348	WerFault.exe	Win7Recovery.exe
312	4680	WerFault.exe	WbVhxCIDDK.exe
3588	2348	WerFault.exe	Win7Recovery.exe
1820	2348	WerFault.exe	Win7Recovery.exe
3008	2348	WerFault.exe	Win7Recovery.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

Processes:

antivirus-platinum.exeWin7Recovery.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Main	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Main\Window Title = "YOUR PC MAY BE INFECTED WITH SPYWARE OR OTHER MALICIOUS ITEMS"	antivirus-platinum.exe
Key created	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Download	Win7Recovery.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	Win7Recovery.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

Processes:

antivirus-platinum.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://secureservices2010.webs.com/scan"	antivirus-platinum.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Version\ = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ListViewCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E791-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}\ = "INodes"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8556BCD2-E01E-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\Version	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B7E638F-850A-101B-AFC0-4210102A8DA7}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7791BA60-E020-11CF-8E74-00A0C90F26F8}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83603-895E-11D0-B0A6-000000000000}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE32-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8D1-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE4-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F08DF953-8592-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0713E8A4-850A-101B-AFC0-4210102A8DA7}\ = "ITreeViewEvents"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE33-8596-11D1-B16A-00C0F0283628}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E6E17E82-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DD9DA666-8594-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED4-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F26-8591-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9ED94440-E5E8-101B-B9B5-444553540000}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C787A50-E01C-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\ = "INode10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4D83602-895E-11D0-B0A6-000000000000}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8B0-850A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ProgCtrl.1\ = "Microsoft ProgressBar Control, version 5.0 (SP2)"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{58DA8D8B-9D6A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8556BCD0-E01E-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A0-850A-101B-AFC0-4210102A8DA7}\TypeLib\Version = "1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{58DA8D91-9D6A-101B-AFC0-4210102A8DA7}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{373FF7F2-EB8B-11CD-8820-08002B2F4F5A}\TypeLib\ = "{6B7E6392-850A-101B-AFC0-4210102A8DA7}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C74190B6-8589-11D1-B16A-00C0F0283628}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE9-8583-11D1-B16A-00C0F0283628}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FED-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\COMCTL.ImageListCtrl\CurVer\ = "COMCTL.ImageListCtrl.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8E-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0713E8A2-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{612A8628-0FB3-11CE-8747-524153480004}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E86-DF38-11CF-8E74-00A0C90F26F8}\ = "ISlider"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7791BA50-E020-11CF-8E74-00A0C90F26F8}\ = "ITabs"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E451-850A-101B-AFC0-4210102A8DA7}\ = "IButtons10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B7E6391-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1EFB6596-857C-11D1-B16A-00C0F0283628}\VersionIndependentProgID\ = "MSComctlLib.TabStrip"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F22-8591-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{66833FE7-8583-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA665-8594-11D1-B16A-00C0F0283628}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{58DA8D8F-9D6A-101B-AFC0-4210102A8DA7}\MiscStatus\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E6E17E8A-DF38-11CF-8E74-00A0C90F26F8}\TypeLib\Version = "1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A5-850A-101B-AFC0-4210102A8DA7}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\MiscStatus\1	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE3C-8596-11D1-B16A-00C0F0283628}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0713E8A0-850A-101B-AFC0-4210102A8DA7}	regsvr32.exe

NTFS ADS 1 IoCs

Processes:

msedge.exe

description ioc process

File opened for modification C:\Users\Admin\Downloads\пездець1488.rar:Zone.Identifier msedge.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Downloads\пездець1488.rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exetaskmgr.exeWin7Recovery.exeWbVhxCIDDK.exe

pid	process
4100	msedge.exe
4100	msedge.exe
3604	msedge.exe
3604	msedge.exe
4200	msedge.exe
4200	msedge.exe
4928	identity_helper.exe
4928	identity_helper.exe
1836	msedge.exe
1836	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe
4680	WbVhxCIDDK.exe
2348	Win7Recovery.exe
2348	Win7Recovery.exe
4680	WbVhxCIDDK.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

AntivirusPro2017.exe

pid process

3740 AntivirusPro2017.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

msedge.exe

pid process

3604 msedge.exe
3604 msedge.exe
3604 msedge.exe
3604 msedge.exe
3604 msedge.exe
3604 msedge.exe
3604 msedge.exe
3604 msedge.exe

pid	process
3740	AntivirusPro2017.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

7zFM.exetaskmgr.exeAUDIODG.EXESpark.exe

description	pid	process
Token: SeRestorePrivilege	4760	7zFM.exe
Token: 35	4760	7zFM.exe
Token: SeSecurityPrivilege	4760	7zFM.exe
Token: SeDebugPrivilege	4044	taskmgr.exe
Token: SeSystemProfilePrivilege	4044	taskmgr.exe
Token: SeCreateGlobalPrivilege	4044	taskmgr.exe
Token: 33	4044	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4044	taskmgr.exe
Token: 33	1128	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1128	AUDIODG.EXE
Token: SeDebugPrivilege	1424	Spark.exe
Token: SeShutdownPrivilege	1424	Spark.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exe7zFM.exeKoteyka2.exeAntivirusPro2017.exetaskmgr.exe

pid	process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
4760	7zFM.exe
4760	7zFM.exe
932	Koteyka2.exe
932	Koteyka2.exe
932	Koteyka2.exe
932	Koteyka2.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

msedge.exeKoteyka2.exeAntivirusPro2017.exetaskmgr.exe

pid	process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
932	Koteyka2.exe
932	Koteyka2.exe
932	Koteyka2.exe
932	Koteyka2.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe
4044	taskmgr.exe

Suspicious use of SetWindowsHookEx 7 IoCs

Processes:

OpenWith.exeantivirus-platinum.exeAntivirusPro2017.exeFreeYoutubeDownloader.exeFreeYoutubeDownloader.exeMEMZ.exe

pid	process
400	OpenWith.exe
3380	antivirus-platinum.exe
3740	AntivirusPro2017.exe
3740	AntivirusPro2017.exe
944	FreeYoutubeDownloader.exe
4000	FreeYoutubeDownloader.exe
4572	MEMZ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3604 wrote to memory of 4896	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 4896	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3532	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 4100	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 4100	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe
PID 3604 wrote to memory of 3732	3604	msedge.exe	msedge.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

Processes:

antivirus-platinum.exeWin7Recovery.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	antivirus-platinum.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	antivirus-platinum.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	Win7Recovery.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	Win7Recovery.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

2808 attrib.exe

pid	process
2808	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://pixeldrain.com/u/QEeXR3cT
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0xdc,0x7fff5c833cb8,0x7fff5c833cc8,0x7fff5c833cd8
2⤵
PID:4896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
2⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2600 /prefetch:8
2⤵
PID:3732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
2⤵
PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
2⤵
PID:440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
2⤵
PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4200

C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
2⤵
PID:3996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
2⤵
PID:3748

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
2⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
2⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,5238901903826850829,15806412385126985425,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2616 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:400

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3452

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\пездець1488.rar"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760

C:\Users\Admin\Desktop\пездець1488\Шутки\Koteyka2\Koteyka2.exe
"C:\Users\Admin\Desktop\пездець1488\Шутки\Koteyka2\Koteyka2.exe"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:932

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Platinum\AntivirusPlatinum.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Platinum\AntivirusPlatinum.exe"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4160

C:\WINDOWS\302746537.exe
"C:\WINDOWS\302746537.exe"
2⤵
- Executes dropped EXE
PID:936

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\F085.tmp\302746537.bat" "
3⤵
PID:884

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\comctl32.ocx
4⤵
- Loads dropped DLL
- Modifies registry class
PID:720

C:\Windows\SysWOW64\regsvr32.exe
regsvr32 /s c:\windows\mscomctl.ocx
4⤵
- Loads dropped DLL
- Modifies registry class
PID:4316

\??\c:\windows\antivirus-platinum.exe
c:\windows\antivirus-platinum.exe
4⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:3380

C:\Windows\SysWOW64\attrib.exe
attrib +h c:\windows\antivirus-platinum.exe
4⤵
- Drops file in Windows directory
- Views/modifies file attributes
PID:2808

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Pro 2017\AntivirusPro2017.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Antivirus Pro 2017\AntivirusPro2017.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3740

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\SecurityScanner\SecurityScanner.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\SecurityScanner\SecurityScanner.exe"
1⤵
- Executes dropped EXE
PID:2968

C:\Users\Admin\Desktop\пездець1488\Трояны\YouAreAnIdiot.exe
"C:\Users\Admin\Desktop\пездець1488\Трояны\YouAreAnIdiot.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4024 -s 1456
2⤵
- Program crash
PID:3152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4024 -ip 4024
1⤵
PID:2064

C:\Users\Admin\Desktop\пездець1488\Рансомы\Xyeta\Xyeta.exe
"C:\Users\Admin\Desktop\пездець1488\Рансомы\Xyeta\Xyeta.exe"
1⤵
- Executes dropped EXE
PID:3696

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3696 -s 476
2⤵
- Program crash
PID:5024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 3696 -ip 3696
1⤵
PID:1252

C:\Users\Admin\Desktop\пездець1488\Трояны\FreeYoutubeDownloader.exe
"C:\Users\Admin\Desktop\пездець1488\Трояны\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:944

C:\Users\Admin\Desktop\пездець1488\Шутки\Hydra\Hydra.exe
"C:\Users\Admin\Desktop\пездець1488\Шутки\Hydra\Hydra.exe"
1⤵
- Executes dropped EXE
PID:3480

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4044

C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Win7Recovery\Win7Recovery.exe
"C:\Users\Admin\Desktop\пездець1488\Фейк-АВ\Win7Recovery\Win7Recovery.exe"
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:2348

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 556
2⤵
- Program crash
PID:2496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 828
2⤵
- Program crash
PID:3652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 872
2⤵
- Program crash
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1020
2⤵
- Program crash
PID:1884

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1064
2⤵
- Program crash
PID:2056

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1064
2⤵
- Program crash
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1084
2⤵
- Program crash
PID:1504

C:\ProgramData\WbVhxCIDDK.exe
"C:\ProgramData\WbVhxCIDDK.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 620
3⤵
- Program crash
PID:312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1252
2⤵
- Program crash
PID:3588

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1636
2⤵
- Program crash
PID:1820

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 1056
2⤵
- Program crash
PID:3008

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2348 -ip 2348
1⤵
PID:4928

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 2348 -ip 2348
1⤵
PID:3332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 2348 -ip 2348
1⤵
PID:3440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2348 -ip 2348
1⤵
PID:2796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 2348 -ip 2348
1⤵
PID:4260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2348 -ip 2348
1⤵
PID:2476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2348 -ip 2348
1⤵
PID:3120

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2348 -ip 2348
1⤵
PID:4060

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4680 -ip 4680
1⤵
PID:3460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2348 -ip 2348
1⤵
PID:5028

C:\Users\Admin\Desktop\пездець1488\Трояны\FreeYoutubeDownloader.exe
"C:\Users\Admin\Desktop\пездець1488\Трояны\FreeYoutubeDownloader.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4000

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004CC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2348 -ip 2348
1⤵
PID:2200

C:\Users\Admin\Desktop\пездець1488\Трояны\MEMZ.exe
"C:\Users\Admin\Desktop\пездець1488\Трояны\MEMZ.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4572

C:\Users\Admin\Desktop\пездець1488\Трояны\Spark.exe
"C:\Users\Admin\Desktop\пездець1488\Трояны\Spark.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1424

C:\Windows\System32\bcdedit.exe
"C:\Windows\System32\bcdedit.exe" -set nointegritychecks on
2⤵
- Modifies boot configuration data using bcdedit
PID:2604

C:\Windows\System32\bcdedit.exe
"C:\Windows\System32\bcdedit.exe" -set testsigning on
2⤵
- Modifies boot configuration data using bcdedit
PID:2600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4680 -ip 4680
1⤵
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 380 -p 4680 -ip 4680
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery