245fe0592a17163fd7d07e20a99f62cf8cd923b196c307b17f73b958686a4244

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 16:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Size 1.8MB
Sample240603-tqaqjadb97
SHA256 245fe0592a17163fd7d07e20a99f62cf8cd923b196c307b17f73b958686a4244
MD5 f8308f715d4be172d3e2d2c4a9b1a276
SHA1 ae3c59e9ba5f4b829f6c422b727a71baa4d67ae4
SHA512 413feff3bc52c7eb8b29d1cbe837d92a2ee624d610ffe435caa9ec6d5fe07fbc72fd3cdfa58cc40257eb9bb1f1c6dd7601189d744c18ccfcda45ac4ced11700a
SSDEEP 24576:I2lmN4R/oxFyXZtGm4JFpOXjq/PJh01Rkf:I2MN4R/TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

spyware stealer

Malware Config

Signatures

Executes dropped EXE 22 IoCs

pid	Process
2256	alg.exe
208	DiagnosticsHub.StandardCollector.Service.exe
1368	fxssvc.exe
4292	elevation_service.exe
2304	elevation_service.exe
3016	maintenanceservice.exe
2212	msdtc.exe
2280	OSE.EXE
3436	PerceptionSimulationService.exe
3128	perfhost.exe
384	locator.exe
3108	SensorDataService.exe
4568	snmptrap.exe
3196	spectrum.exe
1948	ssh-agent.exe
3260	TieringEngineService.exe
4456	AgentService.exe
4940	vds.exe
452	vssvc.exe
1480	wbengine.exe
3884	WmiApSrv.exe
5044	SearchIndexer.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in System32 directory 24 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\msiexec.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\SgrmBroker.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\OpenSSH\ssh-agent.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\vds.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\dllhost.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\wbengine.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\SearchIndexer.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\AgentService.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\fxssvc.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\msdtc.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\SysWow64\perfhost.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\locator.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\SensorDataService.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\snmptrap.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\vssvc.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\System32\alg.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\AppVClient.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe
File opened for modification	C:\Windows\system32\spectrum.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\TieringEngineService.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\wbem\WmiApSrv.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\4e3667aeb3e2edcd.bin	alg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jmap.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmid.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\java.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ieinstal.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\pack200.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_156609\javaws.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\unpack200.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ktab.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\orbd.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARMHelper.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\idlj.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\serialver.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\tnameserv.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\unpack200.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jconsole.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\unpack200.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\klist.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\ExtExport.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javac.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jdb.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\orbd.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Google\Update\Install\{1342F81A-D5C5-42B4-A5E8-933F7759DA30}\chrome_installer.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\jjs.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ExtExport.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsimport.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\javaws.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\klist.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\policytool.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Internet Explorer\iexplore.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\dotnet\dotnet.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\iexplore.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\uninstall.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Internet Explorer\ielowutil.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\extcheck.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	spectrum.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	spectrum.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	SensorDataService.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	TieringEngineService.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	TieringEngineService.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9933 = "MPEG-4 Audio"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SBE	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.WTV\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-34583 = "Saved Pictures"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{E0F158E1-CB04-11D0-BD4E-00A0C911CE86}\Default DirectSound Device	SearchFilterHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-124 = "Microsoft Word Macro-Enabled Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9926 = "M3U file"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-1 = "XML Document"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9908 = "Wave Sound"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-113 = "Microsoft Excel Binary Worksheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-176 = "Microsoft PowerPoint Macro-Enabled Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\OpenWithList	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-103 = "Microsoft Excel Macro-Enabled Worksheet"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SBE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1133 = "Print"	fxssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-12385 = "Favorites Bar"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-912 = "HTML Document"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchFilterHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000e423ef5fd1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-180 = "Microsoft PowerPoint 97-2003 Template"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-172 = "Microsoft PowerPoint 97-2003 Slide Show"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider"	fxssvc.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{80009818-F38F-4AF1-87B5-EADAB9433E58} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000008db84c62d1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9907 = "MIDI Sequence"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-177 = "Microsoft PowerPoint Macro-Enabled Slide Show"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-127 = "OpenDocument Text"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\mshta.exe,-6412 = "HTML Application"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c500536bd1b5da01	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ef096965d1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9912 = "Windows Media Audio file"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006619c860d1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\regedit.exe,-309 = "Registration Entries"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	SearchFilterHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\OpenWithList	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9911 = "Windows Media Audio shortcut"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\windows.storage.dll,-10152 = "File folder"	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{487BA7B8-4DB0-465F-B122-C74A445A095D} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000009a6b3e62d1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\System32\msxml3r.dll,-2 = "XSL Stylesheet"	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@windows.storage.dll,-21825 = "3D Objects"	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{5383EF74-273B-4278-AB0C-CDAA9FD5369E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000eb746561d1b5da01	SearchProtocolHost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows	SearchProtocolHost.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{33154C99-BF49-443D-A73C-303A23ABBE97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 010000000000000087315165d1b5da01	SearchProtocolHost.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9905 = "Video Clip"	SearchProtocolHost.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Token: SeAuditPrivilege	1368	fxssvc.exe
Token: SeRestorePrivilege	3260	TieringEngineService.exe
Token: SeManageVolumePrivilege	3260	TieringEngineService.exe
Token: SeAssignPrimaryTokenPrivilege	4456	AgentService.exe
Token: SeBackupPrivilege	452	vssvc.exe
Token: SeRestorePrivilege	452	vssvc.exe
Token: SeAuditPrivilege	452	vssvc.exe
Token: SeBackupPrivilege	1480	wbengine.exe
Token: SeRestorePrivilege	1480	wbengine.exe
Token: SeSecurityPrivilege	1480	wbengine.exe
Token: 33	5044	SearchIndexer.exe
Token: SeIncBasePriorityPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeTakeOwnershipPrivilege	5044	SearchIndexer.exe
Token: SeDebugPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Token: SeDebugPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Token: SeDebugPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Token: SeDebugPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
Token: SeDebugPrivilege	2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
2320	2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4192	5044	SearchIndexer.exe	120
PID 5044 wrote to memory of 4192	5044	SearchIndexer.exe	120
PID 5044 wrote to memory of 4208	5044	SearchIndexer.exe	121
PID 5044 wrote to memory of 4208	5044	SearchIndexer.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_f8308f715d4be172d3e2d2c4a9b1a276_bkransomware.exe"
1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2320

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:2256

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
1⤵
- Executes dropped EXE
PID:208

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv
1⤵
PID:804

C:\Windows\system32\fxssvc.exe
C:\Windows\system32\fxssvc.exe
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1368

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe"
1⤵
- Executes dropped EXE
PID:2304

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"
1⤵
- Executes dropped EXE
PID:3016

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
PID:2212

\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"
1⤵
- Executes dropped EXE
PID:2280

C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe
1⤵
- Executes dropped EXE
PID:3436

C:\Windows\SysWow64\perfhost.exe
C:\Windows\SysWow64\perfhost.exe
1⤵
- Executes dropped EXE
PID:3128

C:\Windows\system32\locator.exe
C:\Windows\system32\locator.exe
1⤵
- Executes dropped EXE
PID:384

C:\Windows\System32\SensorDataService.exe
C:\Windows\System32\SensorDataService.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3108

C:\Windows\System32\snmptrap.exe
C:\Windows\System32\snmptrap.exe
1⤵
- Executes dropped EXE
PID:4568

C:\Windows\system32\spectrum.exe
C:\Windows\system32\spectrum.exe
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
PID:3196

C:\Windows\System32\OpenSSH\ssh-agent.exe
C:\Windows\System32\OpenSSH\ssh-agent.exe
1⤵
- Executes dropped EXE
PID:1948

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc
1⤵
PID:1732

C:\Windows\system32\TieringEngineService.exe
C:\Windows\system32\TieringEngineService.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\system32\AgentService.exe
C:\Windows\system32\AgentService.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4456

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Executes dropped EXE
PID:4940

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:452

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1480

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
- Executes dropped EXE
PID:3884

C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\SearchIndexer.exe /Embedding
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Windows\system32\SearchProtocolHost.exe
  "C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"
  2⤵
  - Modifies data under HKEY_USERS
  PID:4192
- C:\Windows\system32\SearchFilterHost.exe
  "C:\Windows\system32\SearchFilterHost.exe" 0 916 920 928 8192 924 900
  2⤵
  - Modifies data under HKEY_USERS
  PID:4208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3700 --field-trial-handle=2236,i,5367110156796017614,12594004256180761011,262144 --variations-seed-version /prefetch:8
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

elevation_service.exe

Path C:\Program Files (x86)\Microsoft\Edge\Application\122.0.2365.52\elevation_service.exe
Size 2.2MB
SHA256 9ac2fb1bc0d825787146be30c5f6bfdfbef14c5448f544f2200de86d88e4c04c
MD5 5f33c8c438c47915296ddbd167b84a3e
SHA1 aeb14dd1a0c0f53d5f4c098439c1a86fcd39cbf6
SHA512 e07bd33da1ee2a2cbf99ce0b14cf40e772f96398a1ad1efdabda388c45b550cc92eff459edd72ae1d8b580497cf4e38173d3b022f12115673e0338e8acaf392c
SSDEEP 49152:+7T3mwzw/iYlzGQMebksutsKSSTZgmGLOgPJh0Q:+7Dk/hKuzRxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

maintenanceservice.exe

Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
Size 1.6MB
SHA256 b562f113532909077e6744fb75cb064b31dfc35109a2c29de00682294234f61c
MD5 900cd4c378d79527a0eff03fbb18cb66
SHA1 8665abacafd73a032051a3b148174e5c89746b07
SHA512 914084d0285154dbf3e566cebb6a2f28167a8d11fce9e47ae08cba804c6f097c4fac9ca1c365ee661a65eec28eb14381d020ccf00b275d4e0f9676bf6582d3e1
SSDEEP 24576:lPsJcuiYoxFyXZtGm4JFpOXjq/PJh01Rkf:lwcupTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

OSE.EXE

Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
Size 1.6MB
SHA256 6554e72fae3038f1aa150209422746a69f49f9c609792bd191a7e09a97705a92
MD5 17567597d2e85b4b5b95df8fe32ad4e8
SHA1 caa026dec05bf9c2f366f341a173f059b9e71830
SHA512 e8221a3efceca0bb1b8034830a1e5009022ac84e58cc3c71769dd43e7b8ece6127a538c32034b6da64e79def95ba60e990c08ee9bbf70ab086521ef874425642
SSDEEP 24576:RwuROWFoxFyXZtGm4JFpOXjq/PJh01Rkf:RwSO4TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

elevation_service.exe

Path C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
Size 2.1MB
SHA256 99b6dcd1a25f9d7364a9a068334c3d8f10c1600abb9ff02c930dafe13164ceba
MD5 3014d8fcfb8654519522f31395e35379
SHA1 3aa346ac7f9dac672b4a6d0ea6924d72aa511baf
SHA512 010429abc540706450082e9dc951806905eae000df001e3e802d7605f7c44257cc59d55de6f5a41eface514b3a56b68da9943804ee226e62283423f07b8c3021
SSDEEP 49152:da/3xXBSZ4K5MJ1LvTMxbTsYBYSgxu9+fw4TDTZgmGLOgPJh0Q:1Z4K5MJabTsYNzxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfhost.exe

Path C:\Windows\SysWOW64\perfhost.exe
Size 1.4MB
SHA256 d4b90c36af10a884aca5c68081f8f10e73fad1b6e151c571b0ebeb0db7022385
MD5 5d301d451f622cc2777a6d30637c7d13
SHA1 77c828499309ff5a2ba4b06e2dd6e2b8bb49dbad
SHA512 cb7be894d372bb59983efd030c48a9fefc6317acac0e4e2aed94e1512b27357288dc464571b089719389d539364900907f18e1427d34887510d7efc3814d1bfc
SSDEEP 12288:HSc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:HSoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

AgentService.exe

Path C:\Windows\System32\AgentService.exe
Size 1.7MB
SHA256 758966287fa128eabecda1e906670425c86b629ee078c147f49e71fff5ee1775
MD5 84fdd665d90ef7b975df8e52d072cd95
SHA1 efb0accccf2a87d22138fef0cd9af940912e0bef
SHA512 07ac520c8722b6a154f499645c0aa70e683e5fd9010a6c31ba60f23f7d8b3d67eb5197b7913755b43d760572f20b366295b15bf35876888a11a84b45d8d06edd
SSDEEP 49152:ca0h2GEkuAe73q3pp46zwwQUTZgmGLOgPJh0Q:ca0hNYG4JwUxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

DiagnosticsHub.StandardCollector.Service.exe

Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
Size 1.5MB
SHA256 ae5f45bd8150d705c2a57a1778b0f251e39e78d005fe89a8f5a84df7a09b72f6
MD5 98a0eca9b7a0779b4a5feaa466dd3562
SHA1 30f1ba0bc1d0f4793d1710cc694fb11dfbdf319e
SHA512 e39fcf387ce3eebcb7ddf435381a7d8a2617eafd28aa663e30dc711f75ec09642fc0a1d4033ff987fabdbc3708200bcdfec9113b08299c5cfac348fd00c61c0e
SSDEEP 24576:+hbHjP9oxFyXZtGm4JFpOXjq/PJh01Rkf:+hbHj1TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

FXSSVC.exe

Path C:\Windows\System32\FXSSVC.exe
Size 1.2MB
SHA256 747f1658e2fd322989be0ff29682777f70334b09c6dc028700c4791a2a82d130
MD5 d79b8d885cdb8f871b8ea2a6bd7dac04
SHA1 17d76343b7d74a2e78a62da926e71e8e77b1979f
SHA512 cb186a9b07aeba337111b166e4e1dbcbc6bbce66da9aebeb78184d0067d8befcd1a0ca557da7083e96d2504d7eaeffde6403746ca0b0ae1654cd1faa90f7a02c
SSDEEP 24576:U3YgnJcRTk4yti+R5dpR/FoxFyXZtGm4JFpOXjq/PJh01Rkf:UIgnaTk46ppR/FTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Locator.exe

Path C:\Windows\System32\Locator.exe
Size 1.4MB
SHA256 762c47fe3043e5b5367b9b01b40817f2a8ca728015f290c21eb88fa1d3e068e4
MD5 621076e9aa4a9a31298c66fae54fdff5
SHA1 eeb2518bbb66b5116fbcf2d469ed5f3e4d60363c
SHA512 a7e4d1345b30ff5c1950980fba8bc2beac9beed620a19abc87d3716b893ae8703b4e8df7bce7339d709af84bfbb919cf2f621f886d4497fd7546f9091bafae38
SSDEEP 12288:lec9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:leoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

ssh-agent.exe

Path C:\Windows\System32\OpenSSH\ssh-agent.exe
Size 1.7MB
SHA256 cca8eb0a61a3c55badd9a2cbdb978fc56569c8f5034c13f44e4986e14f25ce56
MD5 7a46df368c9fa5c65d7e00fbff349d27
SHA1 9bd11a73d0bb83d451d3c5e901f4c644b6596c97
SHA512 53ad7149de66a66c2bacc965e5314c77bfa27f3000d3973c455e14c2ffa435c1078e8de7b3e05243a47b87eefc6c9acc2a8ea9bc3f424ea65aa57b4a209bf15f
SSDEEP 24576:0AL3UTvoxFyXZtGm4JFpOXjq/PJh01Rkf:0AL3UbTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

PerceptionSimulationService.exe

Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
Size 1.5MB
SHA256 bed4166570aa2e9d77bde15f8b45355d6c099653379c32a673008356118d6f5e
MD5 3806cc2bd6acbf89bed0cacbbf07e536
SHA1 5db2dccf29c927fdfb72293bc13b79800293b569
SHA512 765a0db5f3d294304de466dd40839c673efda578152068b663aefe52b1e183854749c37f14a1acf6d167d3b5ca943355a5aa61ae1d8fcac909ffd9ddd29d74c0
SSDEEP 12288:HpFtvO7c9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:RO7oxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

SearchIndexer.exe

Path C:\Windows\System32\SearchIndexer.exe
Size 1.4MB
SHA256 a80eb1c2782d8f4dd1e64817c0c69dd65f5440c3f7d04bd5074d42f8c645c426
MD5 8c00f4ec7b90ce146a81154b836a4a16
SHA1 81478c2732d1d14ccd79dbd8f8960837bcc6701f
SHA512 d586baaf0d1fa7869f5006d5e0fbe10a4f7f12718aba573dcd24866f117aa11d495c82f48e8966bf2d6324916fefe4c3c7cb8e067e69cef7e519431f736902f2
SSDEEP 24576:a7NM9YmZqmWMUkPjZM48Mv6bEhsCoxFyXZtGm4JFpOXjq/PJh01Rkf:a7cBWMpPjN8DbEhdTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

SensorDataService.exe

Path C:\Windows\System32\SensorDataService.exe
Size 1.8MB
SHA256 8790dc612520574298dd090fd4910a597733ff0d029917e2c67199f682f73803
MD5 9d6c1f81112220b85ad8056bfadb2b71
SHA1 3348bedc2321a5e7df264ee70d8d39420bff9af0
SHA512 d730349ca807f126a140afbdc79186c04dae59098c3f84eeb08299368a7a487d68ba37304f0c0712d9abc2503639008e738009f2295ba408878545cf0fead404
SSDEEP 49152:FF2YuHNETovcvNYf8kmiTZgmGLOgPJh0Q:g6tCf8kyxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

Spectrum.exe

Path C:\Windows\System32\Spectrum.exe
Size 1.4MB
SHA256 ef543604c1e5f9f6f84a8f46c2d07085d428a16c2e54f063c824c9c4f3bf12c9
MD5 5297a6238e29ea8ecc31f48fe60e397c
SHA1 0ec07637ed6c5805cf868b3489533a7fabc21ab3
SHA512 f405d6ee90382c1623215fe9d85d683fc7ff0b3827807f19a3bd60d0356025903401c17ec0a2598f88dbcddd8e7cf7f6e864c8cb33924870483678df012452f4
SSDEEP 24576:8AFs06+Omlf8NXEbToHoxFyXZtGm4JFpOXjq/PJh01Rkf:RFs060loXu0TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

TieringEngineService.exe

Path C:\Windows\System32\TieringEngineService.exe
Size 1.7MB
SHA256 bcaf51bee522748c115037d89a119dbfa9ef83c9661192f2949852248d1c48ae
MD5 b4cfadc4328fc35390e5a5e12d88038b
SHA1 a12da4fd309b52ffff9149f02018da59c5b47926
SHA512 907ab4eacff9b793250e249f7356c8da58852b1c0285fd55c6dbabe1d9bf32cb01b6a52cc18bcfaf721c4ebe5a9d435eed0391f1393735ffc464fc9a5107d647
SSDEEP 24576:cJnJ5D3Wt0oxFyXZtGm4JFpOXjq/PJh01Rkf:cJnJ5DGt0TZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

VSSVC.exe

Path C:\Windows\System32\VSSVC.exe
Size 2.0MB
SHA256 9973c4623d6932135dde0d24cac366dae05eaa2035fafd78af6e84f4ea8b7c81
MD5 b23535b9711f68e2f667424b78ff6b11
SHA1 615cf931b99de9fdd10c0f95e9cfa2e6981a4d24
SHA512 6406fe87549618c4c57b241ee0fd510243190f5c011821962e5d503eb87b82ecf331152bbfa4aa62c82e256cc93f11da6a53aee3f4ba4222382ea95a5eadae32
SSDEEP 49152:no06DIKdwc+eQnSt65aV2TZgmGLOgPJh0Q:ozxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

alg.exe

Path C:\Windows\System32\alg.exe
Size 1.5MB
SHA256 24f35e07288c7e5ce7cb087392afbfc0f232e91cee588e4b6a369fcb19d76757
MD5 87b432af52ee41b0994f5c9a21a9e370
SHA1 8c8489862a6390d744a9566bea89e5d77c94d17b
SHA512 37f3943f2338ac2b55cf11f90f7ab2072085fe28c5fb60a1dd648047593cccc70c5b0fa99940dfce6296f2d61bbff99a287803ecb1e06c7162006e0c9736310f
SSDEEP 12288:eEP3RrAc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:9rAoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

msdtc.exe

Path C:\Windows\System32\msdtc.exe
Size 1.5MB
SHA256 9077826a6df9a7e88983203c4930ef138e1ceb37c4c63eb1ef4fa27b92a2f6c5
MD5 f01d2c988399949cd4eddb4e247dedc7
SHA1 6273e1af877f0333343e969129199a48b1910b5a
SHA512 aaac19e4f79a738025b3cd801b54667e6ccd9e388c048499d685e6bca2910c72449e49c56783da67be73924d1a3ea48f90dc7a1738031cbe8725e6135003fcf1
SSDEEP 12288:gjkyNc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:gIyNoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

snmptrap.exe

Path C:\Windows\System32\snmptrap.exe
Size 1.4MB
SHA256 0aaa876183dfe72e207f4923cf81688c0fd1222b42683399f2f28982824f8c4f
MD5 0e3768b4921b54da7639081f62c2527f
SHA1 a232138cb1f45b704ab5c5c21ff8c4180256e8fd
SHA512 3228ef3ca5028e703adb904452ab4459f041915d9ed1b9f8c030cab7ca8da31f4449243036f5de6856f97a8c7500302adbbb8d71b2663c2ea89af298afd5f7e3
SSDEEP 12288:XFLc9vZiG+/zjZ+EGd4OfJFpOXjNSN/VtXd7zhNS1RUrfY:1LoxFyXZtGm4JFpOXjq/PJh01Rkf
MD5 SHA1 SHA512 SSDEEP

Submit Download

vds.exe

Path C:\Windows\System32\vds.exe
Size 1.3MB
SHA256 25941f74af164db298c8222649fc2946179e5d6d1c8f880f29c2473588cf816f
MD5 093b022f15fc0f265f1407d84d7aa374
SHA1 212e8dae26a3c1c42295b8319a333edaab05c28f
SHA512 78602f5e517d1ab2a177511373af90068d7a95ff434c49fd9a54fd2e1e69627b3030a52dda5193a6ba81fe7672451b070a5852b71a8d355b7ba672b3af3dcf93
SSDEEP 24576:bQ9MxZKdcz97w3aoxFyXZtGm4JFpOXjq/PJh01Rkf:bVKXaTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApSrv.exe

Path C:\Windows\System32\wbem\WmiApSrv.exe
Size 1.6MB
SHA256 38020e158247063841da7c14007f5ba8f5a788d08c9b04763fc77922923c46c6
MD5 cac3c2730c2a0167a02ab8ca316036b2
SHA1 65b9daf2f6819d4daf6fdf22c6518092863acbb3
SHA512 a6164117149a78fd9c1ec98fb106bde26661182940e754fcc27f5fdd8bed06b2ecd1e80c50c5db01319efa50a206615393327bffed2556bf8e747e78f951e67c
SSDEEP 24576:TyocxAppoxFyXZtGm4JFpOXjq/PJh01Rkf:2ocxAppTZgmGLOgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

wbengine.exe

Path C:\Windows\System32\wbengine.exe
Size 2.1MB
SHA256 99fd7d49c74d04c4d50e4f7cd370c871f16a02c24d44fa59724038f6c1f32594
MD5 47c6eead895984d202fc1fc6ef49af5d
SHA1 f4f62307d467dbfac799e57251498e7b68f1e8a3
SHA512 2dd6d98f49e7d8b7d935197e3ceed8e77c7cb34b502b9f5be88026df7d48c24d8a3f20b5865900d8735bab3b9c8b139217f344dfbee2803b1c3eae0105edf900
SSDEEP 49152:JWcnPqQUGpuphwC0DNLDpaRFXrLuWGMKCIKpTZgmGLOgPJh0Q:x0zuNIIxKgPJh0Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/208-33-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/208-34-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/208-25-0x0000000000690000-0x00000000006F0000-memory.dmp

Download

memory/208-110-0x0000000140000000-0x0000000140246000-memory.dmp

Download

memory/384-139-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/384-255-0x0000000140000000-0x0000000140232000-memory.dmp

Download

memory/452-406-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/452-229-0x0000000140000000-0x00000001401FC000-memory.dmp

Download

memory/1368-45-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1368-38-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1368-39-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1368-47-0x0000000000930000-0x0000000000990000-memory.dmp

Download

memory/1368-50-0x0000000140000000-0x0000000140135000-memory.dmp

Download

memory/1480-241-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1480-425-0x0000000140000000-0x0000000140216000-memory.dmp

Download

memory/1948-179-0x0000000140000000-0x000000014029F000-memory.dmp

Download

memory/1948-352-0x0000000140000000-0x000000014029F000-memory.dmp

Download

memory/2212-91-0x0000000000D60000-0x0000000000DC0000-memory.dmp

Download

memory/2212-190-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2212-90-0x0000000140000000-0x0000000140256000-memory.dmp

Download

memory/2256-12-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2256-18-0x00000000007A0000-0x0000000000800000-memory.dmp

Download

memory/2256-89-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/2256-20-0x0000000140000000-0x0000000140247000-memory.dmp

Download

memory/2280-111-0x0000000140000000-0x000000014026C000-memory.dmp

Download

memory/2280-216-0x0000000140000000-0x000000014026C000-memory.dmp

Download

memory/2304-63-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2304-70-0x0000000000990000-0x00000000009F0000-memory.dmp

Download

memory/2304-67-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2304-166-0x0000000140000000-0x0000000140245000-memory.dmp

Download

memory/2320-6-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/2320-37-0x0000000000400000-0x00000000006A3000-memory.dmp

Download

memory/2320-0-0x0000000000400000-0x00000000006A3000-memory.dmp

Download

memory/2320-7-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/2320-1-0x0000000000C60000-0x0000000000CC7000-memory.dmp

Download

memory/3016-82-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/3016-84-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3016-80-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3016-74-0x0000000000CE0000-0x0000000000D40000-memory.dmp

Download

memory/3016-86-0x0000000140000000-0x0000000140267000-memory.dmp

Download

memory/3108-253-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3108-142-0x0000000140000000-0x00000001401D7000-memory.dmp

Download

memory/3128-128-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/3128-240-0x0000000000400000-0x0000000000634000-memory.dmp

Download

memory/3196-330-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3196-167-0x0000000140000000-0x0000000140169000-memory.dmp

Download

memory/3260-366-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/3260-199-0x0000000140000000-0x000000014027F000-memory.dmp

Download

memory/3436-117-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/3436-228-0x0000000140000000-0x0000000140248000-memory.dmp

Download

memory/3884-438-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/3884-256-0x0000000140000000-0x0000000140263000-memory.dmp

Download

memory/4292-60-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4292-154-0x0000000140000000-0x0000000140237000-memory.dmp

Download

memory/4292-58-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4292-52-0x0000000000510000-0x0000000000570000-memory.dmp

Download

memory/4456-214-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4456-202-0x0000000140000000-0x00000001401C0000-memory.dmp

Download

memory/4568-316-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4568-155-0x0000000140000000-0x0000000140233000-memory.dmp

Download

memory/4940-396-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/4940-217-0x0000000140000000-0x0000000140147000-memory.dmp

Download

memory/5044-268-0x0000000140000000-0x0000000140179000-memory.dmp

Download

memory/5044-449-0x0000000140000000-0x0000000140179000-memory.dmp

Download