bba117558703b80e9e3dec401f3de3989b8ce720e4f5fe07e82a253be6e129fb

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Ghostpress.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 17 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger	Ghostpress.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger = "C:\\Users\\Admin\\Desktop\\Ghostpress.exe"	Ghostpress.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\utilman.exe\Debugger	Ghostpress.exe

Checks BIOS information in registry 2 TTPs 24 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Ghostpress.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Ghostpress.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ghostpress = "\"C:\\Users\\Admin\\Desktop\\Ghostpress.exe\" -autostart"	Ghostpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ghostpress = "\"C:\\Users\\Admin\\Desktop\\Ghostpress.exe\" -autostart"	Ghostpress.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\$RECYCLE.BIN\S-1-5-18\desktop.ini	LogonUI.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	Ghostpress.exe
File opened (read-only)	\??\F:	Ghostpress.exe

Drops file in System32 directory 32 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_16.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_5885B8F65F744CE7B4F7EF3668BDF3F4.dat	Utilman.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db	Ghostpress.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_5885B8F65F744CE7B4F7EF3668BDF3F4.dat	Utilman.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db	Ghostpress.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db	Ghostpress.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs

pid	Process
2896	Ghostpress.exe
1732	Ghostpress.exe
4408	Ghostpress.exe
920	Ghostpress.exe
4604	Ghostpress.exe
2540	Ghostpress.exe
5008	Ghostpress.exe
1948	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
1540	Ghostpress.exe
2900	Ghostpress.exe

Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM\Attributes\Version = "11.0"	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\KeyboardLayout = "67699721"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePidlMRU\*\0 = 14001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c000000000000000000000000000000000000008c00310000000000e958b076110050524f4752417e310000740009000400efbe874fdb49e958b0762e0000003f0000000000010000000000000000004a0000000000cc279a00500072006f006700720061006d002000460069006c0065007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370038003100000018005400310000000000e9588f721000476f6f676c6500003e0009000400efbee9588f72e95892722e000000912f02000000010000000000000000000000000000003aa5050047006f006f0067006c006500000016005400310000000000e958927210004368726f6d6500003e0009000400efbee9588f72e95892722e000000922f02000000010000000000000000000000000000002f1697004300680072006f006d006500000016006000310000000000e958927210004150504c49437e310000480009000400efbee9589272e95892722e00000005300200000001000000000000000000000000000000584b4b004100700070006c00690063006100740069006f006e00000018006000320020512a008258460220006368726f6d652e6578650000460009000400efbee9589272e95892722e00000007300200000001000000000000000000000000000000a4ed63006300680072006f006d0065002e0065007800650000001a000000	Ghostpress.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\French\Attributes	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\Spanish\PhoneMap = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 a 000a e 000b i 000c o 000d u 000e t 000f d 0010 p 0011 b 0012 k 0013 g 0014 ch 0015 jj 0016 f 0017 s 0018 x 0019 m 001a n 001b nj 001c l 001d ll 001e r 001f rr 0020 j 0021 w 0022 th 0023"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\Universal\ = "Universal Phone Converter"	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Autodetection = "0"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Models\1033\L1033	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM\Attributes\SharedPronunciation	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState = 04000000160014001f80cb859f6720028040b29b5540cc05aab60000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f60983ffbb4eac18d42a78ad1f5659cba930000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f50e04fd020ea3a6910a2d808002b30309d0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000000000000000000000000000160014001f580d1a2cf021be504388b07367fc96ef3c0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000000000000000000000000000	Ghostpress.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\English\PhoneMap = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 2 0009 aa 000a ae 000b ah 000c ao 000d aw 000e ax 000f ay 0010 b 0011 ch 0012 d 0013 dh 0014 eh 0015 er 0016 ey 0017 f 0018 g 0019 h 001a ih 001b iy 001c jh 001d k 001e l 001f m 0020 n 0021 ng 0022 ow 0023 oy 0024 p 0025 r 0026 s 0027 sh 0028 t 0029 th 002a uh 002b uw 002c v 002d w 002e y 002f z 0030 zh 0031"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Attributes\Name = "MS-1033-110-WINMO-DNN"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Lts	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_ZiraM\Attributes\SharedPronunciation	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_ZiraM\Attributes\SampleText = "You have selected %1 as the default voice."	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1997270e-0000-0000-0000-d01200000000}	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Ghostpress.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\LocaleHandler\CLSID = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}"	Utilman.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\FileTimeHash = 6792567462650765e9fd3a356360c619d69f1b2e8d89d232ba23699625a979c0	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{59346f67-73b3-4c6a-8dd6-d218c97066f2}\DeviceName = "Speakers (High Definition Audio Device)"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\AudioOutput\TokenEnums\MMAudioOut	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\UXLanguages\Tokens\en-US\Culture = "en-US"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\AudioInput\TokenEnums\MMAudioIn	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\TraditionalChinese	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Attributes\UPSPhoneSet	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_CURRENT_USER\SOFTWARE\Microsoft	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\CurrentUserLexicon\CLSID = "{C9E37C15-DF92-4727-85D6-72E5EEB6995A}"	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{1997270e-0000-0000-0000-d01200000000}\NukeOnDelete = "0"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\International\User Profile\Languages = 65006e002d005500530000000000	LogonUI.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\AudioInput\DefaultDefaultTokenId = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\AudioInput\TokenEnums\MMAudioIn\CLSID = "{14E74C62-DC97-43B0-8F2F-581496A65D60}"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_MarkM\Attributes\Age = "Adult"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_MarkM\Attributes\SampleText = "You have selected %1 as the default voice."	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\Chinese\Attributes	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\UXLanguages	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Recognizers\Tokens\MS-1033-110-WINMO-DNN\Attributes\Vendor = "Microsoft"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_MarkM\Attributes\Language = "409"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}\Files	Utilman.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Modules\NavPane\ExpandedState = 04000000160014001f80cb859f6720028040b29b5540cc05aab60000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f60983ffbb4eac18d42a78ad1f5659cba930000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f50e04fd020ea3a6910a2d808002b30309d0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000ffff00000000000000000000160014001f580d1a2cf021be504388b07367fc96ef3c0000010000004d0000001c00000031535053a66a63283d95d211b5d600c04fd918d0000000002d00000031535053357ec777e31b5043a48c7563d727776d1100000002000000000b000000000000000000000000000000	Ghostpress.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM\Attributes\NarratorTuned = "1"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000\Profile = "{00000000-0000-0000-0000-000000000000}"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\English	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\PhoneConverters\Tokens\French\PhoneMap = "- 0001 ! 0002 & 0003 , 0004 . 0005 ? 0006 _ 0007 1 0008 ~ 0009 aa 000a a 000b oh 000c ax 000d b 000e d 000f eh 0010 ey 0011 f 0012 g 0013 hy 0014 uy 0015 iy 0016 k 0017 l 0018 m 0019 n 001a ng 001b nj 001c oe 001d eu 001e ow 001f p 0020 r 0021 s 0022 sh 0023 t 0024 uw 0025 v 0026 w 0027 y 0028 z 0029 zh 002a"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\SpeechUXPlugins\Tokens	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\UXLanguages\Tokens\en-US\Language = "1033"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_DavidM\Attributes\Vendor = "Microsoft"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput	Utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\Voices	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_ZiraM\ = "Microsoft Zira - English (United States)"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_MarkM\Attributes\DataVersion = "11.0.2013.1022"	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\UXLanguages\Tokens	Utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Keyboard Layout\Preload	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU\	Ghostpress.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech_OneCore\Isolated\_M6z8lKmXOEBnWGxWh0AJSw-8cKykCKrpMeGFDuaH-E\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Speech_OneCore\Voices\Tokens\MSTTS_V110_enUS_MarkM\Attributes\SayAsSupport = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; net=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; Name=NativeSupported; media=NativeSupported; message=NativeSupported; companyName=NativeSupported; computer=NativeSupported; math=NativeSupported; duration=NativeSupported"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{59346f67-73b3-4c6a-8dd6-d218c97066f2}\ = "Speakers (High Definition Audio Device)"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{59346f67-73b3-4c6a-8dd6-d218c97066f2}\DeviceId = "{0.0.0.00000000}.{59346f67-73b3-4c6a-8dd6-d218c97066f2}"	Utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{59346f67-73b3-4c6a-8dd6-d218c97066f2}\Attributes\Vendor = "Microsoft"	Utilman.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0100000000000000ffffffff	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	Ghostpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\SniffedFolderType = "Generic"	Ghostpress.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\NodeSlot = "6"	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	Ghostpress.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 010000000200000000000000ffffffff	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = ffffffff	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	Ghostpress.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202020202	Ghostpress.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	Ghostpress.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	Ghostpress.exe
Key created	\REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings	OpenWith.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
3660	NOTEPAD.EXE
1348	NOTEPAD.EXE

Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery

T1018

pid	Process
4864	PING.EXE
4280	PING.EXE

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

pid	Process
4424	schtasks.exe
3144	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2896	Ghostpress.exe
2896	Ghostpress.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
1732	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe
4408	Ghostpress.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
3300	Ghostpress.exe
1016	Ghostpress.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeDebugPrivilege	2896	Ghostpress.exe
Token: SeDebugPrivilege	1732	Ghostpress.exe
Token: SeDebugPrivilege	4408	Ghostpress.exe
Token: SeDebugPrivilege	920	Ghostpress.exe
Token: SeDebugPrivilege	4604	Ghostpress.exe
Token: SeDebugPrivilege	2540	Ghostpress.exe
Token: SeDebugPrivilege	5008	Ghostpress.exe
Token: SeDebugPrivilege	1948	Ghostpress.exe
Token: SeDebugPrivilege	3300	Ghostpress.exe
Token: 33	2208	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2208	AUDIODG.EXE
Token: SeShutdownPrivilege	2656	LogonUI.exe
Token: SeCreatePagefilePrivilege	2656	LogonUI.exe
Token: SeDebugPrivilege	1016	Ghostpress.exe
Token: SeShutdownPrivilege	2656	LogonUI.exe
Token: SeShutdownPrivilege	2656	LogonUI.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1980	AcroRd32.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
3300	Ghostpress.exe
1016	Ghostpress.exe
3300	Ghostpress.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
2896	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe

Suspicious use of SetWindowsHookEx 37 IoCs

pid	Process
2896	Ghostpress.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
1980	AcroRd32.exe
2016	OpenWith.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
3300	Ghostpress.exe
2656	LogonUI.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
4332	Utilman.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
1016	Ghostpress.exe
4388	Utilman.exe
1016	Ghostpress.exe
1016	Ghostpress.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2896 wrote to memory of 4328	2896	Ghostpress.exe	105
PID 2896 wrote to memory of 4328	2896	Ghostpress.exe	105
PID 2896 wrote to memory of 4328	2896	Ghostpress.exe	105
PID 2896 wrote to memory of 4424	2896	Ghostpress.exe	107
PID 2896 wrote to memory of 4424	2896	Ghostpress.exe	107
PID 2896 wrote to memory of 4424	2896	Ghostpress.exe	107
PID 1980 wrote to memory of 1424	1980	AcroRd32.exe	115
PID 1980 wrote to memory of 1424	1980	AcroRd32.exe	115
PID 1980 wrote to memory of 1424	1980	AcroRd32.exe	115
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 396	1424	RdrCEF.exe	116
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117
PID 1424 wrote to memory of 4644	1424	RdrCEF.exe	117

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Ghostpress.zip
1⤵
PID:2268

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3472

C:\Users\Admin\Desktop\Ghostpress.exe
"C:\Users\Admin\Desktop\Ghostpress.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:4328
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8" /xml "C:\Users\Admin\Desktop\Ghostpress_Data\SkipUAC.xml"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4424
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:3624
- C:\Users\Admin\Desktop\Ghostpress.exe
  "C:\Users\Admin\Desktop\Ghostpress.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
    3⤵
    PID:3732
- - C:\Users\Admin\Desktop\Ghostpress.exe
    "C:\Users\Admin\Desktop\Ghostpress.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks BIOS information in registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4408
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
      4⤵
      PID:2528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\Help.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1424
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A26F1EE648353E469E77E8437530DDF --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:396
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=158028CCC663F0C08A62369AB0656A84 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=158028CCC663F0C08A62369AB0656A84 --renderer-client-id=2 --mojo-platform-channel-handle=1780 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4644
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B500B0D8C555F2F6D467C99332FFB9C8 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D6D69999C2380946F5CC2939046836DF --mojo-platform-channel-handle=1976 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3166B05BD8BDF4666DDBE3F681C99FF1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3166B05BD8BDF4666DDBE3F681C99FF1 --renderer-client-id=6 --mojo-platform-channel-handle=2448 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2928
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=937EF6C5C7ADAEBB44E109489DAB98C4 --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3912

C:\Users\Admin\Desktop\Ghostpress.exe
"C:\Users\Admin\Desktop\Ghostpress.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:920
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:4192
- C:\Users\Admin\Desktop\Ghostpress.exe
  "C:\Users\Admin\Desktop\Ghostpress.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:4604
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
    3⤵
    PID:3648
- - C:\Users\Admin\Desktop\Ghostpress.exe
    "C:\Users\Admin\Desktop\Ghostpress.exe"
    3⤵
    - Identifies VirtualBox via ACPI registry values (likely anti-VM)
    - Event Triggered Execution: Image File Execution Options Injection
    - Checks BIOS information in registry
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:2540
  - - C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
      4⤵
      PID:3176

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Error.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:3660

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2016

C:\Users\Admin\Desktop\Ghostpress.exe
"C:\Users\Admin\Desktop\Ghostpress.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:5008
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:3868
- C:\Users\Admin\Desktop\Ghostpress.exe
  "C:\Users\Admin\Desktop\Ghostpress.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Event Triggered Execution: Image File Execution Options Injection
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of AdjustPrivilegeToken
  PID:1948
- - C:\Windows\SysWOW64\schtasks.exe
    "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
    3⤵
    PID:1884

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Ghostpress_Data\Reset All.cmd" "
1⤵
PID:744
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 5
  2⤵
  - Runs ping.exe
  PID:4280

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Ghostpress_Data\Lang\EN.ini
1⤵
- Opens file in notepad (likely ransom note)
PID:1348

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\Ghostpress_Data\Reset Setup.cmd" "
1⤵
PID:2648
- C:\Windows\system32\PING.EXE
  ping 127.0.0.1 -n 5
  2⤵
  - Runs ping.exe
  PID:4864

C:\Users\Admin\Desktop\Ghostpress.exe
"C:\Users\Admin\Desktop\Ghostpress.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3300
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:4604
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8" /xml "C:\Users\Admin\Desktop\Ghostpress_Data\SkipUAC.xml"
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3144
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:4648

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x328 0x4ac
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2208

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa38e7055 /state1:0x41c64e6d
1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2656

C:\Users\Admin\Desktop\Ghostpress.exe
C:\Users\Admin\Desktop\Ghostpress.exe utilman.exe /debug
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1016
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:1884
- C:\Windows\SysWOW64\schtasks.exe
  "schtasks.exe" /Query /TN Ghostpress_SkipUAC_4EE9CE50356D01809D0E4F8C1E96CBB8
  2⤵
  PID:1268

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}
1⤵
PID:412

C:\Users\Admin\Desktop\Ghostpress.exe
C:\Users\Admin\Desktop\Ghostpress.exe utilman.exe /debug
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:1540
- C:\Windows\SysWOW64\Utilman.exe
  "C:\Windows\System32\Utilman.exe"
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4332

C:\Users\Admin\Desktop\Ghostpress.exe
C:\Users\Admin\Desktop\Ghostpress.exe utilman.exe /debug
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Event Triggered Execution: Image File Execution Options Injection
- Checks BIOS information in registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2900
- C:\Windows\SysWOW64\Utilman.exe
  "C:\Windows\System32\Utilman.exe"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:4388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Image File Execution Options Injection

T1546.012

Scheduled Task/Job

T1053

Scheduled Task

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery