47dca4e070081df4b70053c858a851dbd720845d4ac579eb5e7334a44ffa16c7

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswElam\ImagePath = "system32\\drivers\\aswElam.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys"	instup.exe

Executes dropped EXE 31 IoCs

pid	Process
4108	avast_free_antivirus_setup_online.exe
1880	avast_free_antivirus_setup_online_x64.exe
2608	instup.exe
5088	instup.exe
820	aswOfferTool.exe
2276	aswOfferTool.exe
2324	aswOfferTool.exe
2408	aswOfferTool.exe
4964	aswOfferTool.exe
760	aswOfferTool.exe
4828	aswOfferTool.exe
4588	aswOfferTool.exe
4852	sbr.exe
10108	SetupInf.exe
10160	SetupInf.exe
10184	SetupInf.exe
10216	SetupInf.exe
4696	SetupInf.exe
5620	AvEmUpdate.exe
10356	AvEmUpdate.exe
8632	RegSvr.exe
8668	RegSvr.exe
8712	RegSvr.exe
8744	RegSvr.exe
8800	AvastNM.exe
8836	SetupInf.exe
8924	overseer.exe
8936	engsup.exe
9184	wsc_proxy.exe
1060	avDump.exe
9276	engsup.exe

Loads dropped DLL 59 IoCs

pid	Process
4108	avast_free_antivirus_setup_online.exe
2608	instup.exe
2608	instup.exe
2608	instup.exe
2608	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
2324	aswOfferTool.exe
4964	aswOfferTool.exe
4828	aswOfferTool.exe
4588	aswOfferTool.exe
10356	AvEmUpdate.exe
10356	AvEmUpdate.exe
10356	AvEmUpdate.exe
10356	AvEmUpdate.exe
10356	AvEmUpdate.exe
8632	RegSvr.exe
8668	RegSvr.exe
8712	RegSvr.exe
8712	RegSvr.exe
8712	RegSvr.exe
8712	RegSvr.exe
8744	RegSvr.exe
8744	RegSvr.exe
8744	RegSvr.exe
8744	RegSvr.exe
8744	RegSvr.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
8936	engsup.exe
2732	Process not Found
5088	instup.exe
9184	wsc_proxy.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
9276	engsup.exe
3288	Process not Found

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 13 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32\ThreadingModel = "Both"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3C5422B3-D1E2-449E-A736-809C934C2F80}\InprocServer32	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ReleaseName = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\Avast Software\\Avast\\ashShell.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ = "C:\\Program Files\\Avast Software\\Avast\\asOutExt.dll"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B342E21B-AD7E-4568-AE3F-D0D844537A7A}\InprocServer32\ThreadingModel = "Apartment"	RegSvr.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF}	instup.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait"	instup.exe

Checks for any installed AV software in registry 1 TTPs 64 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\InstallTime	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder = "C:\\Program Files\\Avast Software\\Avast\\setup"	instup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MicroUpdates = 3300310037003d00310037003100380034003200360031003400340000003400330039003d00310037003100380034003200360031003400340000003400390034003d00310037003100380034003200360031003400340000003500320038003d00310037003100380034003200360031003400340000003700330034003d00310037003100380034003200360031003400340000003700360032003d00310037003100380034003200360031003400340000000000	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	instup.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MicroUpdates	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder	engsup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	instup.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense\SelfDefense	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	wsc_proxy.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	instup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\	RegSvr.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\EmUpdateBurgerEvents	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile	SetupInf.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupLog	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages\Engine = "1033"	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\CrashGuard	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	wsc_proxy.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	instup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common	SetupInf.exe
Key enumerated	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings	SetupInf.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LastAppliedPatchId	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder	SetupInf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 17 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online_x64.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	wsc_proxy.exe
File opened for modification	\??\PhysicalDrive0	avast_free_antivirus_setup_online.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	SetupInf.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	RegSvr.exe
File opened for modification	\??\PhysicalDrive0	instup.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\asw85812656caffa63d.tmp	instup.exe
File created	C:\Windows\system32\asw85812656caffa63d.tmp	instup.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	SetupInf.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\db_el.dat.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-conio-l1-1-0.dll.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\aswbe4a929930491cd4.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswb5858be0dbb2ce47.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\RegSvr.exe	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Setup\29dc3b37-896a-41c2-b8b8-4d7dfaa39688	AvEmUpdate.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswd821be5cb9cc5891.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\msvcp140_codecvt_ids.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\aswHds.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\db_tx.dat.sum	instup.exe
File created	\??\c:\program files\avast software\avast\setup\57ee7125-ce31-4ecd-b636-02226ac9f44b\avast5.ini.171842614400004	AvEmUpdate.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\asw363fd24d6c0a796b.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw7502f494f9366655.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\aswdca6353532bdcd36.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw61f658469ceecd70.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\ArPot.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\db_str.nmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\event_manager.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRdr2.sys.sum	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24061317\asw44a957e029453834.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24061317\aswe6265bc21259e9a2.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswSnx.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\aswbde98cec3d3655ca.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\asw4a0a37a73ab2be9b.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\aswbb0463d048c6372c.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24061317\aswe34e9ecd17565aac.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw2a75ecd86c209d49.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswidpm.dll	instup.exe
File created	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswbidsh.sys	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswd0599a009dbddfd7.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Setup\be414a13-ae30-4ec4-8aec-d5486e6fd754\939FCC52A506AC288462DBF67B2585D4.rmt	AvEmUpdate.exe
File created	C:\Program Files\Avast Software\Avast\RescueDisk\aswa0e0a28079cd56ca.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\aswe44f90fb7998a259.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\asw8b0c2f446d5c7c9c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\db_java.sig.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw30f9fa3ea58e9bb7.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\asw646baf98656babfe.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\RescueDisk\aswc1e64f8f04658e7f.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswb52a68e78f988dd0.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswCmnBS.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswProperty.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\api-ms-win-crt-runtime-l1-1-0.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\msvcp140_atomic_wait.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw25ad3fdc23e1045f.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw3211c03b22c74c4e.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw224ca4f277b55320.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\aswbbff5ae131313cfd.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw0847edefda4e8dde.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\db_w6.sig	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\vcruntime140.dll	instup.exe
File created	C:\Program Files\Avast Software\Avast\asw1f800e703acbe0e4.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\TuneupSmartScan.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-profile-l1-1-0.dll	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswVmm.sys	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\defs\24061317\asw6f48f96f7abf8923.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\Licenses\aswac4a6cb90afa2687.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\defs\24061317\db_dyna.map	engsup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\Licenses\asw43fa1632b527312c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\nos.dll.sum	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\aswf3a806d9fabd62b8.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\aswec72f3e7f17ebd93.tmp	instup.exe
File created	C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw95d34c9c8bf1b86c.tmp	instup.exe
File opened for modification	C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswbidsh.sys	instup.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\ELAMBKUP\asw6070bf67633eda9e.tmp	instup.exe
File opened for modification	C:\Windows\ELAMBKUP\asw6070bf67633eda9e.tmp	instup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 11 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	instup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	instup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	instup.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvastNM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	avast_free_antivirus_setup_online_x64.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	instup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	instup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	avast_free_antivirus_setup_online_x64.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	AvEmUpdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	instup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate	instup.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133628995539624976"	chrome.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswAMSI.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mfc140.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\asOutExt64.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "21"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_gen_protobuf_x64-7d3.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_bank.dat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: crts.cat"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\custody.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Installing kernel driver: aswSP"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_dll_eng_x64"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: proximanova-bold.otf"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: libwaapi.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: gaming_hook.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswLog.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-interlocked-l1-1-0.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FB904E4E-D2C7-4C8D-8492-B620BB9896B1}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "58"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_dll_eng-887.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: BrowserCleanup.ini"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: firefox_pass.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswStm.sys"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "24"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: RobotoCondensed-Regular.ttf"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-localization-l1-2-0.dll"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avastconfigfile\shell\open\command	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "45"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswPEShell.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\aswBoot.exe"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\aswSZB.dll"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "93"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: log.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\avast.vc140.mfc"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Installing kernel driver: aswVmm"	instup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Avast.AsOutExt.1	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Calling named action: AcsSaveHardwareId"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: wa_3rd_party_host_32.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "2"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "14"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_gen_tools"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: dnd_helper.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: intel_asm.txt"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F64B349A-BD50-415F-9F99-72E00C161493}\TypeLib\ = "{EDDBDEA4-5C07-453F-BE8C-81D738984381}"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F64B349A-BD50-415F-9F99-72E00C161493}\TypeLib\ = "{EDDBDEA4-5C07-453F-BE8C-81D738984381}"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "60"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: fwAux.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x64\\aswbdiska.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Windows\\system32\\drivers\\aswbdiskx.sys"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\iplugins-*.vpx"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "22"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_cmp_rescuedisk_x64-8d4.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_js.nmp"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswpsic.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Replacing files"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avastconfigfile\ = "avast! config file"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "8"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswRunDll.exe"	instup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "33"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\AhAScr.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Avast.AsOutExt\CurVer\ = "Avast.AsOutExt.1"	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "File downloaded: ais_gen_crt_x64-834.vpx"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ArPotEx64.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ashBase.dll"	instup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Windows\\system32\\drivers\\aswbidsdriverx.sys"	instup.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Kiwi X.rar:Zone.Identifier	chrome.exe
File opened for modification	C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe:Zone.Identifier	chrome.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3452	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
1976	chrome.exe
1976	chrome.exe
1880	avast_free_antivirus_setup_online_x64.exe
1880	avast_free_antivirus_setup_online_x64.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
5088	instup.exe
1060	avDump.exe
1060	avDump.exe
5088	instup.exe
5088	instup.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
3488	OpenWith.exe
4836	OpenWith.exe
3452	vlc.exe
10448	taskmgr.exe

Suspicious behavior: LoadsDriver 13 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe
Token: SeShutdownPrivilege	3556	chrome.exe
Token: SeCreatePagefilePrivilege	3556	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3556	chrome.exe
3556	chrome.exe
5088	instup.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3556	chrome.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
3452	vlc.exe
5088	instup.exe
5088	instup.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe
10448	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3488	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
4836	OpenWith.exe
3452	vlc.exe
4108	avast_free_antivirus_setup_online.exe
1880	avast_free_antivirus_setup_online_x64.exe
2608	instup.exe
2608	instup.exe
5088	instup.exe
5088	instup.exe
820	aswOfferTool.exe
2276	aswOfferTool.exe
2324	aswOfferTool.exe
2408	aswOfferTool.exe
760	aswOfferTool.exe
4588	aswOfferTool.exe
5088	instup.exe
4852	sbr.exe
10108	SetupInf.exe
10160	SetupInf.exe
10184	SetupInf.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 1004	3556	chrome.exe	86
PID 3556 wrote to memory of 1004	3556	chrome.exe	86
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 2256	3556	chrome.exe	87
PID 3556 wrote to memory of 4976	3556	chrome.exe	88
PID 3556 wrote to memory of 4976	3556	chrome.exe	88
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89
PID 3556 wrote to memory of 1972	3556	chrome.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Flash.swf
1⤵
PID:844

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3488

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff9d662ab58,0x7ff9d662ab68,0x7ff9d662ab78
  2⤵
  PID:1004
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:2
  2⤵
  PID:2256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2184 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3516 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4408 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4352 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4456 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --reenable-autoupdates --system-level
  2⤵
  PID:3048
- - C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe
    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x250,0x254,0x258,0x22c,0x25c,0x7ff72eadae48,0x7ff72eadae58,0x7ff72eadae68
    3⤵
    PID:3320
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4800 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2780 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5100 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4932 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:8
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3252 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5128 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2120
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=3204 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=5304 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=5180 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=5432 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:724
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=4384 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --mojo-platform-channel-handle=3300 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:4936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=5536 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=5808 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --mojo-platform-channel-handle=3340 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5964 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2676
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6000 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  - NTFS ADS
  PID:2248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5688 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=4956 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:688
- C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe
  "C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of SetWindowsHookEx
  PID:4108
- - C:\Windows\Temp\asw.fbfd292fe45274b4\avast_free_antivirus_setup_online_x64.exe
    "C:\Windows\Temp\asw.fbfd292fe45274b4\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_012_999_z8f_m:dlid_FAV-PPC /ga_clientid:6222f2d6-fb4e-43dc-995e-250f0fa19559 /edat_dir:C:\Windows\Temp\asw.fbfd292fe45274b4
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of SetWindowsHookEx
    PID:1880
  - - C:\Windows\Temp\asw.752327387a3ce6ac\instup.exe
      "C:\Windows\Temp\asw.752327387a3ce6ac\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.752327387a3ce6ac /edition:1 /prod:ais /stub_context:feba86e6-c05a-4f88-94c0-5617ac1eee97:9897680 /guid:21dfe533-df70-44e6-9f28-74f106251ca8 /ga_clientid:6222f2d6-fb4e-43dc-995e-250f0fa19559 /cookie:mmm_ava_012_999_z8f_m:dlid_FAV-PPC /ga_clientid:6222f2d6-fb4e-43dc-995e-250f0fa19559 /edat_dir:C:\Windows\Temp\asw.fbfd292fe45274b4
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Checks for any installed AV software in registry
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Modifies registry class
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\instup.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.752327387a3ce6ac /edition:1 /prod:ais /stub_context:feba86e6-c05a-4f88-94c0-5617ac1eee97:9897680 /guid:21dfe533-df70-44e6-9f28-74f106251ca8 /ga_clientid:6222f2d6-fb4e-43dc-995e-250f0fa19559 /cookie:mmm_ava_012_999_z8f_m:dlid_FAV-PPC /edat_dir:C:\Windows\Temp\asw.fbfd292fe45274b4 /online_installer
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Windows security modification
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Checks processor information in registry
        Enumerates system info in registry
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" -checkGToolbar -elevated
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:820
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" /check_secure_browser
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" -checkChrome -elevated
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2408
        
        C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4964
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:760
        
        C:\Users\Public\Documents\aswOfferTool.exe
        
        "C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC
        7⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:4828
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\aswOfferTool.exe" -checkChrome -elevated
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:4588
      - C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\sbr.exe
        
        "C:\Windows\Temp\asw.752327387a3ce6ac\New_180517e4\sbr.exe" 5088 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4852
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:10108
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:10160
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:10184
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:10216
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:4696
      - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        
        PID:5620
      - C:\Program Files\Avast Software\Avast\AvEmUpdate.exe
        
        "C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer1
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Checks processor information in registry
        
        PID:10356
      - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies Internet Explorer settings
        Modifies registry class
        
        PID:8632
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies Internet Explorer settings
        
        PID:8668
      - C:\Program Files\Avast Software\Avast\x86\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\asOutExt.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies registry class
        
        PID:8712
      - C:\Program Files\Avast Software\Avast\RegSvr.exe
        
        "C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\asOutExt.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Modifies registry class
        
        PID:8744
      - C:\Program Files\Avast Software\Avast\AvastNM.exe
        
        "C:\Program Files\Avast Software\Avast\AvastNM.exe" /install
        6⤵
        Executes dropped EXE
        Checks processor information in registry
        
        PID:8800
      - C:\Program Files\Avast Software\Avast\SetupInf.exe
        
        "C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB11
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Checks processor information in registry
        
        PID:8836
      - C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe
        
        "C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        
        PID:8924
      - C:\Program Files\Avast Software\Avast\defs\24061317\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24061317\engsup.exe" /prepare_definitions_folder
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Drops file in Program Files directory
        Checks processor information in registry
        
        PID:8936
      - C:\Program Files\Avast Software\Avast\wsc_proxy.exe
        
        "C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        
        PID:9184
        
        C:\Program Files\Avast Software\Avast\avDump.exe
        
        "C:\Program Files\Avast Software\Avast\avDump.exe" --pid 9184 --exception_ptr 000000AA8F7EE790 --thread_id 9188 --dump_level 0 --handle_data 1 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311129252140711694x-manual.mdmp" --comment "Cause: VectoredExceptionHandler Exception: sd is not loaded" --min_interval 60
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        
        PID:1060
      - C:\Program Files\Avast Software\Avast\defs\24061317\engsup.exe
        
        "C:\Program Files\Avast Software\Avast\defs\24061317\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Checks processor information in registry
        
        PID:9276
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=6400 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6644 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6660 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6876 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5580 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --mojo-platform-channel-handle=4856 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --mojo-platform-channel-handle=5752 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --mojo-platform-channel-handle=5112 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:908
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --mojo-platform-channel-handle=5772 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:8
  2⤵
  PID:2832
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=1452 --field-trial-handle=1820,i,2114666985254322280,3959499363340520221,131072 /prefetch:1
  2⤵
  PID:9788

C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
1⤵
PID:688

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4836
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\Kiwi X.rar"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3452

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SendNotifyMessage
PID:10448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery