Overview
overview
6Static
static
3sketchyori...eTswap
ubuntu-18.04-amd64
6sketchyori...eTswap
debian-9-armhf
1sketchyori...eTswap
debian-9-mips
sketchyori...eTswap
debian-9-mipsel
sketchyori...ty.lnk
windows7-x64
3sketchyori...ty.lnk
windows10-2004-x64
3sketchyori...et.lnk
windows7-x64
3sketchyori...et.lnk
windows10-2004-x64
3sketchyori...ll.lnk
windows7-x64
3sketchyori...ll.lnk
windows10-2004-x64
3sketchyori...ls.lnk
windows7-x64
3sketchyori...ls.lnk
windows10-2004-x64
3sketchyori...ip.lnk
windows7-x64
3sketchyori...ip.lnk
windows10-2004-x64
3sketchyori...og.lnk
windows7-x64
3sketchyori...og.lnk
windows10-2004-x64
3sketchyori...11.lnk
windows7-x64
1sketchyori...11.lnk
windows10-2004-x64
1sketchyori...allpkg
ubuntu-18.04-amd64
6sketchyori...allpkg
debian-9-armhf
1sketchyori...allpkg
debian-9-mips
sketchyori...allpkg
debian-9-mipsel
sketchyori...sm.pdf
windows7-x64
1sketchyori...sm.pdf
windows10-2004-x64
1sketchyori...rg.pdf
windows7-x64
1sketchyori...rg.pdf
windows10-2004-x64
1sketchyori...js.pdf
windows7-x64
1sketchyori...js.pdf
windows10-2004-x64
1sketchyori...js.pdf
windows7-x64
1sketchyori...js.pdf
windows10-2004-x64
1sketchyori...js.pdf
windows7-x64
1sketchyori...js.pdf
windows10-2004-x64
1Resubmissions
12-06-2024 17:05
240612-vmcamasdqh 612-06-2024 16:56
240612-vft7vsscma 712-06-2024 16:50
240612-vcjxqasbna 612-06-2024 16:40
240612-t6wb6swank 6Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2024 16:40
Static task
static1
Behavioral task
behavioral1
Sample
sketchyorignorant-main/SeTswap
Resource
ubuntu1804-amd64-20240611-en
Behavioral task
behavioral2
Sample
sketchyorignorant-main/SeTswap
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral3
Sample
sketchyorignorant-main/SeTswap
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral4
Sample
sketchyorignorant-main/SeTswap
Resource
debian9-mipsel-20240226-en
Behavioral task
behavioral5
Sample
sketchyorignorant-main/System and Security.lnk
Resource
win7-20240508-en
Behavioral task
behavioral6
Sample
sketchyorignorant-main/System and Security.lnk
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
sketchyorignorant-main/The Internet.lnk
Resource
win7-20240508-en
Behavioral task
behavioral8
Sample
sketchyorignorant-main/The Internet.lnk
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
sketchyorignorant-main/Windows Defender Firewall.lnk
Resource
win7-20240508-en
Behavioral task
behavioral10
Sample
sketchyorignorant-main/Windows Defender Firewall.lnk
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
sketchyorignorant-main/Windows Tools.lnk
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
sketchyorignorant-main/Windows Tools.lnk
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
sketchyorignorant-main/clamav-1.2.0.win.x64.zip.lnk
Resource
win7-20240611-en
Behavioral task
behavioral14
Sample
sketchyorignorant-main/clamav-1.2.0.win.x64.zip.lnk
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
sketchyorignorant-main/error.log.lnk
Resource
win7-20240221-en
Behavioral task
behavioral16
Sample
sketchyorignorant-main/error.log.lnk
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
sketchyorignorant-main/https--account.microsoft.com-ref=settings&Platform=Windows11.lnk
Resource
win7-20231129-en
Behavioral task
behavioral18
Sample
sketchyorignorant-main/https--account.microsoft.com-ref=settings&Platform=Windows11.lnk
Resource
win10v2004-20240226-en
Behavioral task
behavioral19
Sample
sketchyorignorant-main/installpkg
Resource
ubuntu1804-amd64-20240508-en
Behavioral task
behavioral20
Sample
sketchyorignorant-main/installpkg
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral21
Sample
sketchyorignorant-main/installpkg
Resource
debian9-mipsbe-20240418-en
Behavioral task
behavioral22
Sample
sketchyorignorant-main/installpkg
Resource
debian9-mipsel-20240418-en
Behavioral task
behavioral23
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_browser_omni.ja!_chrome_browser_res_activity-stream_lib_ASRoute6r.jsm.pdf
Resource
win7-20240508-en
Behavioral task
behavioral24
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_browser_omni.ja!_chrome_browser_res_activity-stream_lib_ASRoute6r.jsm.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targ.pdf
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targ.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral27
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targe7ting.sys.mjs.pdf
Resource
win7-20240508-en
Behavioral task
behavioral28
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targe7ting.sys.mjs.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targeting.sys.5mjs.pdf
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targeting.sys.5mjs.pdf
Resource
win10v2004-20240611-en
Behavioral task
behavioral31
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targeting.sys.mjs.pdf
Resource
win7-20240508-en
Behavioral task
behavioral32
Sample
sketchyorignorant-main/jar file ___usr_lib_firefox_omni.ja!_chrome_toolkit_res_messaging-system_targeting_Targeting.sys.mjs.pdf
Resource
win10v2004-20240611-en
General
-
Target
sketchyorignorant-main/System and Security.lnk
-
Size
116B
-
MD5
8fb20e2bf62079c3d4ec6271601cbdf5
-
SHA1
d9a40f421163a5f6cb729f9dd4dfb919d5e55cfa
-
SHA256
dbc3c145520f48524ec7b67c0d2ef434df4811598f4dc40f6b1b19b7edd8eb81
-
SHA512
6c3ff6849f79c87bb5897a933f628fcc471d9ed7b6c95f76dcc230cb30adc56d14092e4078fcd1645f74ce7709fb7f5d6b27e83211cf8bb5b18879d19adb6a97
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe -
Modifies registry class 64 IoCs
Processes:
explorer.execmd.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4313#immutable1 = "Configure your Internet display and connection settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15301#immutable1 = "Manage your RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3000#immutable1 = "Sync Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-1000#immutable1 = "Devices and Printers" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-1#immutable1 = "Credential Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-103#immutable1 = "Customize your keyboard settings, such as the cursor blink rate and the character repeat rate." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-15#immutable1 = "Troubleshoot and fix common computer problems." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-2#immutable1 = "Keep a history of your files" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-300#immutable1 = "Sound" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-100#immutable1 = "Mouse" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-1#immutable1 = "System" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-1#immutable1 = "BitLocker Drive Encryption" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-2#immutable1 = "Configure how speech recognition works on your computer." explorer.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-1#immutable1 = "Power Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-2#immutable1 = "Change user account settings and passwords for people who share this computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-2#immutable1 = "Customize settings for the display of languages, numbers, times, and dates." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-7#immutable1 = "Change advanced color management settings for displays, scanners, and printers." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fvecpl.dll,-2#immutable1 = "Protect your PC using BitLocker Drive Encryption." explorer.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\powercpl.dll,-2#immutable1 = "Conserve energy or maximize performance by choosing how your computer manages power." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-45#immutable1 = "Make your computer easier to use." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-2#immutable1 = "Recovery" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\colorcpl.exe,-6#immutable1 = "Color Management" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-1#immutable1 = "Phone and Modem" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\Speech\SpeechUX\speechuxcpl.dll,-1#immutable1 = "Speech Recognition" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-4#immutable1 = "Device Manager" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\inetcpl.cpl,-4312#immutable1 = "Internet Options" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-10#immutable1 = "Choose which programs you want Windows to use for activities like web browsing, editing photos, sending e-mail, and playing music." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\telephon.cpl,-2#immutable1 = "Configure your telephone dialing rules and modem settings." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\usercpl.dll,-1#immutable1 = "User Accounts" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-1#immutable1 = "AutoPlay" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\mmsys.cpl,-301#immutable1 = "Configure your audio devices or change the sound scheme for your computer." explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\SyncCenter.dll,-3001#immutable1 = "Sync files between your computer and network folders" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-101#immutable1 = "Backup and Restore (Windows 7)" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\RADCUI.dll,-15300#immutable1 = "RemoteApp and Desktop Connections" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-102#immutable1 = "Keyboard" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-602#immutable1 = "Change how Windows indexes to search faster" explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 4172 explorer.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
explorer.exedescription pid process Token: SeShutdownPrivilege 4172 explorer.exe Token: SeCreatePagefilePrivilege 4172 explorer.exe Token: SeShutdownPrivilege 4172 explorer.exe Token: SeCreatePagefilePrivilege 4172 explorer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
explorer.exepid process 4172 explorer.exe
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\sketchyorignorant-main\System and Security.lnk"1⤵
- Modifies registry class
PID:3312
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4172
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}1⤵PID:1260