Resubmissions
03-08-2024 13:07
240803-qcmw6ayenf 1003-08-2024 13:02
240803-p9sy1aydqc 303-08-2024 12:59
240803-p76gbaydld 8Analysis
-
max time kernel
812s -
max time network
815s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
03-08-2024 13:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bullet4life
Resource
win11-20240802-en
General
-
Target
https://bullet4life
Malware Config
Extracted
crimsonrat
185.136.161.124
Signatures
-
CrimsonRAT main payload 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000200000002b949-21551.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
avDump.exedescription pid Process procid_target PID 12136 created 8640 12136 avDump.exe 281 -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
Solara.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Solara.exe -
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
Processes:
resource yara_rule behavioral1/memory/12768-21808-0x0000000006220000-0x0000000006248000-memory.dmp rezer0 -
Blocklisted process makes network request 3 IoCs
Processes:
msiexec.exepowershell.exeflow pid Process 611 12248 msiexec.exe 667 11552 powershell.exe 670 11552 powershell.exe -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
setup.exedescription ioc Process Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698} setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\ = "Avast Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\StubPath = "\"C:\\Program Files\\AVAST Software\\Browser\\Application\\126.0.25735.183\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\Localized Name = "Avast Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A8504530-742B-42BC-895D-2BAD6406F698}\Version = "43,0,0,0" setup.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 64 IoCs
Processes:
instup.exeGnil.exeGnil.exeGnil.exeGnil.exeAvEmUpdate.exedescription ioc Process File opened for modification C:\Windows\system32\drivers\asw5d8056ff0e0cd426.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswRdr2.sys instup.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe:Zone.Identifier:$DATA Gnil.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA Gnil.exe File created C:\Windows\system32\drivers\aswed0e65f3a73b8cf7.tmp instup.exe File created C:\Windows\system32\drivers\aswffad9299c34836dd.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswRvrt.sys instup.exe File created C:\Windows\system32\drivers\aswMonFlt.sys instup.exe File created C:\Windows\system32\drivers\aswdae1dc695d4c5039.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswArPot.sys instup.exe File created C:\Windows\system32\drivers\aswbidsdriver.sys instup.exe File created C:\Windows\system32\drivers\aswbidsh.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw54e20c8b12f9f881.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw6416a7ada7b083be.tmp instup.exe File created C:\Windows\system32\drivers\asw6416a7ada7b083be.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswVmm.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswdae1dc695d4c5039.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswffe72f44fafe822e.tmp instup.exe File created C:\Windows\system32\drivers\asw5d8056ff0e0cd426.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswStm.sys instup.exe File created C:\Windows\system32\drivers\aswVmm.sys instup.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe:SmartScreen:$DATA Gnil.exe File created C:\Windows\system32\drivers\asw54c3fa99790ca2d8.tmp instup.exe File created C:\Windows\system32\drivers\aswed9f8430b7c0b18b.tmp instup.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe:Zone.Identifier:$DATA Gnil.exe File created C:\Windows\system32\drivers\aswArDisk.sys instup.exe File created C:\Windows\system32\drivers\aswKbd.sys instup.exe File created C:\Windows\system32\drivers\aswStm.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw14b074dfd9de0d3d.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswElam.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswMonFlt.sys instup.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe:Zone.Identifier:$DATA Gnil.exe File created C:\Windows\system32\drivers\aswae6621b51aa98572.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswae6621b51aa98572.tmp instup.exe File created C:\Windows\system32\drivers\aswRvrt.sys instup.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File opened for modification C:\Windows\system32\drivers\aswc31bd86c96e82704.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswbuniv.sys instup.exe File created C:\Windows\system32\drivers\aswffe72f44fafe822e.tmp instup.exe File created C:\Windows\system32\drivers\aswRdr2.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswKbd.sys instup.exe File created C:\Windows\system32\drivers\aswNetHub.sys instup.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File created C:\Windows\system32\drivers\aswb9aacafe2ea92ddf.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswArDisk.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswNetHub.sys instup.exe File created C:\Windows\system32\drivers\aswbuniv.sys instup.exe File created C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File opened for modification C:\Windows\system32\drivers\asw6adea62b5b8226e5.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswSnx.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswed9f8430b7c0b18b.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswffad9299c34836dd.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswSP.sys instup.exe File created C:\Windows\system32\drivers\aswVmm.sys AvEmUpdate.exe File opened for modification C:\Windows\system32\drivers\asw54c3fa99790ca2d8.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswed0e65f3a73b8cf7.tmp instup.exe File created C:\Windows\system32\drivers\aswSP.sys instup.exe File opened for modification C:\Windows\SysWOW64\drivers\spoclsv.exe Gnil.exe File created C:\Windows\system32\drivers\asw14b074dfd9de0d3d.tmp instup.exe File created C:\Windows\system32\drivers\aswc31bd86c96e82704.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswbidsh.sys instup.exe File created C:\Windows\system32\drivers\asw54e20c8b12f9f881.tmp instup.exe File created C:\Windows\system32\drivers\asw6adea62b5b8226e5.tmp instup.exe -
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
Processes:
AvastBrowserUpdate.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastBrowserUpdate.exe AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AvastBrowserUpdate.exe\DisableExceptionChainValidation = "0" AvastBrowserUpdate.exe -
Sets service image path in registry 2 TTPs 15 IoCs
Processes:
instup.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswElam\ImagePath = "system32\\drivers\\aswElam.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys" instup.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Solara.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Solara.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Solara.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AvastUI.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Control Panel\International\Geo\Nation AvastUI.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 64 IoCs
Processes:
avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeaswOfferTool.exesecurebrowser_setup.exeAvastBrowserUpdateSetup.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserInstaller.exesetup.exesetup.exeAvastBrowserCrashHandler.exeAvastBrowserCrashHandler64.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeelevation_service.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeelevation_service.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeelevation_service.exeelevation_service.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exepid Process 4908 avast_free_antivirus_setup_online.exe 2172 avast_free_antivirus_setup_online_x64.exe 3440 instup.exe 1432 instup.exe 4700 aswOfferTool.exe 5116 aswOfferTool.exe 580 aswOfferTool.exe 788 aswOfferTool.exe 3252 aswOfferTool.exe 444 aswOfferTool.exe 2340 aswOfferTool.exe 4724 aswOfferTool.exe 2768 sbr.exe 11272 SetupInf.exe 11324 SetupInf.exe 11356 SetupInf.exe 11396 SetupInf.exe 11436 SetupInf.exe 11476 aswOfferTool.exe 11512 securebrowser_setup.exe 11928 AvastBrowserUpdateSetup.exe 5640 AvastBrowserUpdate.exe 8420 AvastBrowserUpdate.exe 8504 AvastBrowserUpdate.exe 8452 AvastBrowserUpdateComRegisterShell64.exe 8160 AvastBrowserUpdateComRegisterShell64.exe 8520 AvastBrowserUpdateComRegisterShell64.exe 8572 AvastBrowserUpdate.exe 8588 AvastBrowserUpdate.exe 8648 AvastBrowserUpdate.exe 8876 AvastBrowserInstaller.exe 8988 setup.exe 9036 setup.exe 5628 AvastBrowserCrashHandler.exe 6852 AvastBrowserCrashHandler64.exe 9288 AvastBrowser.exe 9304 AvastBrowser.exe 9532 AvastBrowser.exe 9540 AvastBrowser.exe 9604 AvastBrowser.exe 9764 elevation_service.exe 9928 AvastBrowser.exe 9936 AvastBrowser.exe 9916 AvastBrowser.exe 9104 AvastBrowser.exe 10312 AvastBrowser.exe 10340 elevation_service.exe 9888 AvastBrowser.exe 12520 AvastBrowser.exe 12544 AvastBrowser.exe 12744 AvastBrowser.exe 12764 AvastBrowser.exe 12836 AvastBrowser.exe 12880 elevation_service.exe 13072 elevation_service.exe 13188 AvastBrowser.exe 13296 AvastBrowser.exe 11160 AvastBrowser.exe 11212 AvastBrowser.exe 7992 AvastBrowser.exe 1732 AvastBrowser.exe 3364 AvastBrowser.exe 3192 AvastBrowser.exe 8976 AvastBrowser.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
Processes:
instup.exedescription ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys\ = "Driver" instup.exe -
Loads dropped DLL 64 IoCs
Processes:
avast_free_antivirus_setup_online.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesecurebrowser_setup.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exepid Process 4908 avast_free_antivirus_setup_online.exe 3440 instup.exe 3440 instup.exe 3440 instup.exe 3440 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 580 aswOfferTool.exe 3252 aswOfferTool.exe 2340 aswOfferTool.exe 4724 aswOfferTool.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 5640 AvastBrowserUpdate.exe 8420 AvastBrowserUpdate.exe 8504 AvastBrowserUpdate.exe 8452 AvastBrowserUpdateComRegisterShell64.exe 8504 AvastBrowserUpdate.exe 8160 AvastBrowserUpdateComRegisterShell64.exe 8504 AvastBrowserUpdate.exe 8520 AvastBrowserUpdateComRegisterShell64.exe 8504 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 8572 AvastBrowserUpdate.exe 8588 AvastBrowserUpdate.exe 8648 AvastBrowserUpdate.exe 8648 AvastBrowserUpdate.exe 8588 AvastBrowserUpdate.exe 8648 AvastBrowserUpdate.exe 11512 securebrowser_setup.exe 9288 AvastBrowser.exe 9304 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9532 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9540 AvastBrowser.exe 9532 AvastBrowser.exe 9532 AvastBrowser.exe 9604 AvastBrowser.exe 9540 AvastBrowser.exe 9540 AvastBrowser.exe 9604 AvastBrowser.exe 9604 AvastBrowser.exe 9532 AvastBrowser.exe 9532 AvastBrowser.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/12936-25861-0x0000000180000000-0x0000000180A7C000-memory.dmp themida behavioral1/memory/12936-26370-0x0000000180000000-0x0000000180A7C000-memory.dmp themida -
Processes:
resource yara_rule behavioral1/memory/5788-21026-0x0000000010000000-0x0000000010030000-memory.dmp upx behavioral1/memory/5788-21029-0x0000000010000000-0x0000000010030000-memory.dmp upx -
Processes:
instup.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} instup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} instup.exe -
Adds Run key to start application 2 TTPs 5 IoCs
Processes:
instup.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "\"C:\\Program Files\\Avast Software\\Avast\\AvLaunch.exe\" /gui" instup.exe Set value (str) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastBrowserAutoLaunch_1088872FC4C2207C6D62AF0E8871CAAC = "\"C:\\Program Files\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AvastBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastBrowserAutoLaunch_1088872FC4C2207C6D62AF0E8871CAAC = "\"C:\\Program Files\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AvastBrowser.exe Set value (str) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\Microsoft\Windows\CurrentVersion\Run\AvastBrowserAutoLaunch_1088872FC4C2207C6D62AF0E8871CAAC = "\"C:\\Program Files\\AVAST Software\\Browser\\Application\\AvastBrowser.exe\" --check-run=src=logon --auto-launch-at-startup --profile-directory=\"Default\"" AvastBrowser.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
Processes:
AvastUI.exeAvastNM.exeAvEmUpdate.exeAvastUI.exeinstup.exeSetupInf.exeAvastUI.exeAvastUI.exeAvastNM.exeAvastBrowser.exeAvastNM.exeAvastUI.exeAvastNM.exeSetupInf.exeRegSvr.exeAvastUI.exeSetupInf.exeAvastUI.exeSetupInf.exeAvastBrowser.exeSetupInf.exewsc_proxy.exeengsup.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\RespectHighContrast AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages AvastUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-661032028-162657920-1226909816-1000\Software\AVAST Software\Avast\HideBalloon = 01000000 AvastUI.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AvastUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Version AvastBrowser.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion AvastUI.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion AvastUI.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings AvastUI.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast AvastNM.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties AvastNM.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages RegSvr.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast SetupInf.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MicroUpdates = 3300310037003d00310037003200320036003900300036003600380000003400330039003d00310037003200320036003900300036003600380000003400390034003d00310037003200320036003900300036003600380000003500320038003d00310037003200320036003900300036003600380000003700330034003d00310037003200320036003900300036003600380000000000 AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CertificateFile instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder RegSvr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\CrashGuardProcessWatcherExclusions SetupInf.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages SetupInf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\ SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile SetupInf.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\ SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder AvastUI.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties AvastUI.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common SetupInf.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion RegSvr.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings wsc_proxy.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\UseRegistry AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\CrashGuard SetupInf.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder engsup.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\UserInterface AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder AvastNM.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\Instup_IgnoredDownloadTypes instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Scanner AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\WriteFullDumps AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ProgramFolder AvastUI.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
securebrowser_setup.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA securebrowser_setup.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\G: msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 7 IoCs
Processes:
flow ioc 422 raw.githubusercontent.com 447 raw.githubusercontent.com 512 camo.githubusercontent.com 590 pastebin.com 597 pastebin.com 614 raw.githubusercontent.com 622 pastebin.com -
Writes to the Master Boot Record (MBR) 1 TTPs 34 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
AvastBrowser.exeAvastUI.exeAvastBrowser.exeAvastBrowser.exeAvastUI.exeinstup.exeSetupInf.exeAvastBrowser.exeoverseer.exeAvastUI.exeavast_free_antivirus_setup_online_x64.exeinstup.exeSetupInf.exeavast_free_antivirus_setup_online.exesecurebrowser_setup.exeAvastBrowserUpdate.exeSetupInf.exeAvastUI.exeAvastUI.exeAvastBrowser.exeSetupInf.exeAvastBrowser.exeAvastBrowser.exeAvEmUpdate.exeRegSvr.exewsc_proxy.exeRegSvr.exeAvastUI.exeAvastUI.exeSetupInf.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeSetupInf.exeAvastUI.exedescription ioc Process File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 overseer.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 avast_free_antivirus_setup_online_x64.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 avast_free_antivirus_setup_online.exe File opened for modification \??\PhysicalDrive0 securebrowser_setup.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvastBrowser.exe File opened for modification \??\PhysicalDrive0 AvEmUpdate.exe File opened for modification \??\PhysicalDrive0 RegSvr.exe File opened for modification \??\PhysicalDrive0 wsc_proxy.exe File opened for modification \??\PhysicalDrive0 RegSvr.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AvastBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe -
Checks system information in the registry 2 TTPs 8 IoCs
System information is often read in order to detect sandboxing environments.
Processes:
AvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer AvastBrowser.exe -
Drops file in System32 directory 3 IoCs
Processes:
instup.exeSetupInf.exedescription ioc Process File created C:\Windows\system32\asw19670295c28a663a.tmp instup.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt SetupInf.exe File opened for modification C:\Windows\system32\asw19670295c28a663a.tmp instup.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
Solara.exepid Process 12936 Solara.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
WarzoneRAT.exedescription pid Process procid_target PID 12768 set thread context of 10500 12768 WarzoneRAT.exe 412 -
Drops file in Program Files directory 64 IoCs
Processes:
msiexec.exeinstup.exeAvastBrowserUpdate.exeengsup.exeAvEmUpdate.exesetup.exeAvastBrowserUpdateSetup.exedescription ioc Process File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\lib\index.mjs msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\lru-cache\index.mjs msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-pack.md msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\docs\content\commands\npm-edit.md msiexec.exe File created C:\Program Files\Avast Software\Avast\asw2299ed61c44ccd59.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\asw0cf4ceba396eeb70.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\perfstats.dll.sum instup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\goopdateres_iw.dll AvastBrowserUpdate.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\smart-buffer\LICENSE msiexec.exe File opened for modification C:\Program Files\Avast Software\Avast\aswRvrt.dll instup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\postcss-selector-parser\package.json msiexec.exe File created C:\Program Files\Avast Software\Avast\defs\24080204\aswb1b2c7a48d00b2af.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\RescueDisk\asw0412c6d71f145098.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\asw8de635f00815e76a.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\asw0cbed80c389748d6.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\kin.js.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\setup\part-vps_windows-24080204.vpx instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24080204\aswbb48c9d2b53852d2.tmp instup.exe File created C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\aswb7b6067d20fa5b86.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswff63e8210489fb4b.tmp instup.exe File created C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswa7aac0523cd07b44.tmp instup.exe File created C:\Program Files\Avast Software\Avast\defs\24080204\avast.local_vc142.crt\api-ms-win-core-processthreads-l1-1-1.dll engsup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\pacote\lib\git.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\minimatch\dist\cjs\index-cjs.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\deprecate.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\tuf-js\dist\models\signature.d.ts msiexec.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24080204\asw1137ae619c52d87d.tmp instup.exe File created C:\Program Files\Avast Software\Avast\locales\aswc9e2cb1bb9c336a5.tmp instup.exe File created C:\Program Files\nodejs\node_modules\npm\docs\output\commands\npm-docs.html msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\sigstore\dist\types\sigstore\__generated__\sigstore_bundle.d.ts msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\wcwidth\LICENSE msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\cidr-regex\index.d.ts msiexec.exe File created C:\Program Files\nodejs\npm msiexec.exe File created C:\Program Files\Avast Software\Avast\defs\24080204\asw93bfba2158f03081.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\aswce4a449786cb97cc.tmp instup.exe File created C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\goopdateres_ar.dll AvastBrowserUpdate.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\node-gyp\gyp\CODE_OF_CONDUCT.md msiexec.exe File created C:\Program Files\Avast Software\Avast\Licenses\asw96b92e36221fba01.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswecc3cc1919ed0663.tmp instup.exe File created C:\Program Files\Avast Software\Avast\Setup\f960679a-8097-4511-8f49-a9a9b1f480fd.cab AvEmUpdate.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\bin-links\lib\bin-target.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\emoji-regex\es2015\text.js msiexec.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswf6c205d7398ca286.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\firefox_pass.exe instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-da.json instup.exe File created C:\Program Files\Avast Software\Avast\Setup\cccd2cab-867b-41d6-9e50-6ee0d80e36bf.ini AvEmUpdate.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\aswf9381d2dedd0e687.tmp instup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\humanize-ms\LICENSE msiexec.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24080204\aswQcr.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRdr2.sys.sum instup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\readable-stream\lib\internal\streams\end-of-stream.js msiexec.exe File created C:\Program Files\nodejs\node_modules\npm\lib\commands\link.js msiexec.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\asw7102e21d217dc2dc.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24080204\aswJsFlt64.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\Licenses\protobuf.txt.sum instup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\diff\release-notes.md msiexec.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24080204\def.ini instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-utility-l1-1-0.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\it.pak.sum instup.exe File created C:\Program Files\AVAST Software\Browser\Application\SetupMetrics\29b480d7-c8cd-498a-af06-d6a0b83fb8ab.tmp setup.exe File created C:\Program Files\Avast Software\Avast\defs\24080204\aswd282718d8607dcf1.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\setup\AvDump.exe instup.exe File created C:\Program Files (x86)\GUM8222.tmp\psuser.dll AvastBrowserUpdateSetup.exe File created C:\Program Files\nodejs\node_modules\npm\node_modules\path-is-absolute\index.js msiexec.exe -
Drops file in Windows directory 64 IoCs
Processes:
AvastBrowser.exemsiexec.exesetup.exesetup.exechrmstp.exechrmstp.exedescription ioc Process File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-hr.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_787560212\male_names.txt AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1436516026\_platform_specific\win_x64\widevinecdm.dll.sig AvastBrowser.exe File created C:\Windows\SystemTemp\~DF64E8CA3C22E12172.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_631815018\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_366107959\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_2012613358\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-sk.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-mn-cyrl.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-gl.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1436516026\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1106378062\manifest.fingerprint AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-ga.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\~DF8E87C0E553BB99EB.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1441656153\_metadata\verified_contents.json AvastBrowser.exe File opened for modification C:\Windows\Installer\MSIB16E.tmp msiexec.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1106378062\privacy-sandbox-attestations.dat AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_2044643431\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-or.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-ml.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-la.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-de-ch-1901.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-as.hyb AvastBrowser.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1323660048\LICENSE AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_787560212\us_tv_and_film.txt AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-mul-ethi.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-en-gb.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\~DF92C15640CFE35432.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_750830814\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_780113003\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_366107959\manifest.fingerprint AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_787560212\manifest.fingerprint AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1534979729\keys.json AvastBrowser.exe File opened for modification C:\Windows\Installer\MSIBCC0.tmp msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_569035897\manifest.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_2044643431\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-sv.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-mr.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_862172521\download_file_types.pb AvastBrowser.exe File created C:\Windows\Installer\SourceHash{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC} msiexec.exe File created C:\Windows\Installer\e5f1937.msi msiexec.exe File opened for modification C:\Windows\SystemTemp AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-pa.hyb AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-bg.hyb AvastBrowser.exe File created C:\Windows\Installer\e5f1932.msi msiexec.exe File created C:\Windows\SystemTemp\~DF216FB665A9588B26.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_569035897\Filtering Rules AvastBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_750830814\Preload Data AvastBrowser.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_1323660048\manifest.json AvastBrowser.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat chrmstp.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_2012613358\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\Installer\e5f192e.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_750830814\_metadata\verified_contents.json AvastBrowser.exe File created C:\Windows\Installer\{EFA235B5-C6A1-42E6-9BC9-02A8D56F1CDC}\NodeIcon msiexec.exe File created C:\Windows\SystemTemp\~DF87F515EED497EFC5.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping10348_267128926\hyph-de-1996.hyb AvastBrowser.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DF41A495064E8015E7.TMP msiexec.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 10 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Gnil.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\robux.exe:Zone.Identifier msedge.exe -
Embeds OpenSSL 5 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
Processes:
resource yara_rule behavioral1/files/0x000100000002ac51-2309.dat embeds_openssl behavioral1/files/0x000100000002ac72-2414.dat embeds_openssl behavioral1/files/0x000100000002ae03-5339.dat embeds_openssl behavioral1/files/0x000500000002aba1-5331.dat embeds_openssl behavioral1/files/0x000100000002ac4d-3240.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 8296 5788 WerFault.exe 370 -
System Location Discovery: System Language Discovery 1 TTPs 41 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
aswOfferTool.exeAvastBrowserUpdate.exeGnil.exeGnil.exeFloxif.exeWinNuke.98.exeAvastBrowserUpdate.exemelter.exeavast_free_antivirus_setup_online.exeAvastBrowserUpdate.exeGnil.exeGnil.exeMabezat.exesecurebrowser_setup.exeAvastBrowserUpdate.exeRegSvr.exeschtasks.exeBootstrapper.exemsiexec.exewevtutil.exeaswOfferTool.exeAvastBrowserUpdateSetup.exeAvastBrowserUpdate.exeaswOfferTool.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeMsiExec.exeaswOfferTool.exeaswOfferTool.exeWarzoneRAT.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeMSBuild.exeAvastBrowserUpdate.exeMsiExec.exerobux.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Floxif.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WinNuke.98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language melter.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avast_free_antivirus_setup_online.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Gnil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Mabezat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language securebrowser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Bootstrapper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wevtutil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdateSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WarzoneRAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AvastBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language robux.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 9 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
msedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exemsedgewebview2.exeAvastBrowserUpdate.exemsedgewebview2.exemsedgewebview2.exepid Process 12256 msedgewebview2.exe 460 msedgewebview2.exe 11032 msedgewebview2.exe 1880 msedgewebview2.exe 5948 msedgewebview2.exe 10620 msedgewebview2.exe 8572 AvastBrowserUpdate.exe 10164 msedgewebview2.exe 6284 msedgewebview2.exe -
Checks SCSI registry key(s) 3 TTPs 30 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
AvastUI.exeinstup.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exesecurebrowser_setup.exeAvastBrowser.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 instup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 AvastUI.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI securebrowser_setup.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom AvastUI.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI securebrowser_setup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 instup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom instup.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI AvastBrowser.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags AvastUI.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AvastNM.exeinstup.exewsc_proxy.exeinstup.exeSetupInf.exechrome.exeSetupInf.exeAvastNM.exeAvastNM.exeAvastBrowser.exeengsup.exeAvastNM.exeWarzoneRAT.exeAvastNM.exeengsup.exeAvastUI.exeAvastUI.exeAvastNM.exeAvastUI.exeAvastUI.exeSetupInf.exeRegSvr.exeAvastBrowser.exeAvastNM.exeSetupInf.exeAvEmUpdate.exechrome.exeSetupInf.exeAvastBrowser.exeWScript.exeAvEmUpdate.exeRegSvr.exeSetupInf.exeAvastUI.exemsedgewebview2.exepowershell.exeavast_free_antivirus_setup_online_x64.exedescription ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature wsc_proxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastBrowser.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 engsup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WarzoneRAT.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision engsup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 engsup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wsc_proxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegSvr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastNM.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegSvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastNM.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastBrowser.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WScript.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvEmUpdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegSvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision engsup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature RegSvr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision msedgewebview2.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 powershell.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature WScript.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision wsc_proxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature avast_free_antivirus_setup_online_x64.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 8540 timeout.exe -
Enumerates system info in registry 2 TTPs 23 IoCs
Processes:
AvastBrowser.exeAvastBrowser.exeAvastBrowser.exemsedge.exechrome.exemsedgewebview2.exeAvastBrowser.exeinstup.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\Bios instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer AvastBrowser.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Processes:
AvastBrowserUpdate.exeRegSvr.exeRegSvr.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\AppName = "AvastBrowserUpdateBroker.exe" AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\Policy = "3" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation RegSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\AppName = "AvastBrowserUpdateWebPlugin.exe" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\AppPath = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1697.6" AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C}\Policy = "3" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80} RegSvr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation RegSvr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80} RegSvr.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{4424021B-831C-4F50-A74F-1AF30ADA650C} AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85} AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{62593C70-ACF0-44CC-8716-990919D46A85}\AppPath = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1697.6" AvastBrowserUpdate.exe -
Modifies data under HKEY_USERS 35 IoCs
Processes:
AvastBrowserUpdate.exeAvastBrowser.exeAvastBrowserUpdate.exeAvastBrowser.exemsiexec.exechrome.exeAvastBrowser.exedescription ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\MachineId = "0000cbc4aa53932df6468356dc6cec24" AvastBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AvastBrowser.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\ AvastBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AvastBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\hostprefix AvastBrowserUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = d82f00005223122ba7e5da01 msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\endpoint = "update.avastbrowser.com" AvastBrowserUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AvastBrowserUpdate.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser AvastBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update AvastBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\devmode = "0" AvastBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 78754b198d74b9e8a5c18fdabe5e33ddb6739b041316acd4979e10bee557ac56 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software AvastBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVAST Software\Browser\Update\MachineIdDate = "20240803" AvastBrowserUpdate.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry AvastBrowser.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVAST Software AvastBrowserUpdate.exe -
Modifies registry class 64 IoCs
Processes:
AvastBrowserUpdate.exeAvastBrowserUpdateComRegisterShell64.exeinstup.exeAvastBrowserUpdateComRegisterShell64.exesetup.exemsiexec.exeAvastBrowserUpdateComRegisterShell64.exeinstup.exeavast_free_antivirus_setup_online_x64.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\ProxyStubClsid32\ = "{D1E03992-3598-4135-8589-B27B3357CD8D}" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "61" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_array.dat" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods\ = "10" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.CoCreateAsync.1.0\CLSID\ = "{BCDCF02F-B457-36D7-9215-FBE3FFC929BC}" AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID\{620A093F-79D3-4CAB-8CAD-EB1A39A8C0A2} setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\22BA3C918173D4E42B3042F2051065B5\Language = "1033" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\aswhookx.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Users\\Public\\Desktop\\Avast Antivirus Gratuit.lnk" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\AvDump64.exe" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\AVAST Software\\Avast One Essential.lnk" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\libssl-1_1.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\asOutExt.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D1E03992-3598-4135-8589-B27B3357CD8D}\InProcServer32\ = "C:\\Program Files (x86)\\AVAST Software\\Browser\\Update\\1.8.1697.6\\psmachine_64.dll" AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswpsicx.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\x86\\avast.vc140.debugmfc" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Users\\Public\\Desktop\\avast!*.lnk" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ais_dll_eng" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BA03866-1403-40EA-81A9-23FCD97810E2}\ProxyStubClsid32\ = "{D1E03992-3598-4135-8589-B27B3357CD8D}" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.ProcessLauncher\CLSID\ = "{C2033652-2F07-34CC-9416-76BC5C9AD5F7}" AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: locale-id.json" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.Update3WebMachineFallback\CLSID AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "39" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: vi.pak" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: locale-fi.json" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\RescueDisk\\uiLangRes.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\x86\\aswHwid.sys" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40} AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AvastBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\ = "IProgressWndEvents" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.MiscUtils.1.0\CLSID AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A3A70C74FE2431248AD5F8A59570C782\5B532AFE1A6C6E24B99C208A5DF6C1CD msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\NumMethods AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{99F8769E-4FE9-3A40-9D6D-5424B8AC9F57}\InprocServer32 AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6E3A7FED-773C-3232-B213-43DD2C627B4C} AvastBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mainSprite.css" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D37D106C-CDD2-4821-BC7A-F08990DDCA74}\NumMethods AvastBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "100" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: AvastUI.exe" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: kin.js" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Uninstalling kernel driver: aswlog" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "18" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: db_qcr.dat" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: api-ms-win-core-console-l1-1-0.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\gaming_mode_ui.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Installing kernel driver: aswNetHub" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2DAE1732-F855-42A3-9D28-B7F6E291ECCD}\ProxyStubClsid32 AvastBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC} AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.MiscUtils AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "6" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "87" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: cef.txt" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}\ = "ICredentialDialog" AvastBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AvastUpdate.CoreMachineClass.1 AvastBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "39" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Main = "52" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mfcm140u.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\ais_cmp_secdns-*.vpx" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6972DB5C-E9D6-4A81-B352-B415A3A61CA6}\NumMethods\ = "24" AvastBrowserUpdateComRegisterShell64.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\SfxInstProgress = "42" avast_free_antivirus_setup_online_x64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: dndrules.dat" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mainLayout.js" instup.exe -
NTFS ADS 24 IoCs
Processes:
msedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exeWarzoneRAT.exemsedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Gnil.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\WinNuke.98.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 323055.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 40521.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\MadMan.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 373267.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\CrimsonRAT.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 809874.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 898278.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 423237.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Floxif.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 302544.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 946456.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\WarzoneRAT.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Bootstrapper.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\robux.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 766546.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 72893.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\Mabezat.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 719334.crdownload:SmartScreen msedge.exe File created C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:SmartScreen:$DATA WarzoneRAT.exe File created C:\Users\Admin\AppData\Roaming\jFvfxe.exe\:Zone.Identifier:$DATA WarzoneRAT.exe File opened for modification C:\Users\Admin\Downloads\Solara.Dir.zip:Zone.Identifier msedge.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeavast_free_antivirus_setup_online_x64.exeinstup.exemsedge.exesecurebrowser_setup.exeAvastBrowserUpdate.exepid Process 4796 msedge.exe 4796 msedge.exe 1400 msedge.exe 1400 msedge.exe 3436 msedge.exe 3436 msedge.exe 2724 identity_helper.exe 2724 identity_helper.exe 1728 msedge.exe 1728 msedge.exe 2452 msedge.exe 2452 msedge.exe 2172 avast_free_antivirus_setup_online_x64.exe 2172 avast_free_antivirus_setup_online_x64.exe 2172 avast_free_antivirus_setup_online_x64.exe 2172 avast_free_antivirus_setup_online_x64.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 5008 msedge.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 11512 securebrowser_setup.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe 5640 AvastBrowserUpdate.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
msedge.exeAvastUI.exepid Process 1400 msedge.exe 11452 AvastUI.exe -
Suspicious behavior: LoadsDriver 15 IoCs
Processes:
pid Process 680 680 680 680 680 680 680 680 680 680 680 680 680 680 680 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exeAvastBrowser.exepid Process 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 9288 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 12520 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 7104 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 10348 AvastBrowser.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
avast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exedescription pid Process Token: 32 2172 avast_free_antivirus_setup_online_x64.exe Token: SeDebugPrivilege 2172 avast_free_antivirus_setup_online_x64.exe Token: SeDebugPrivilege 3440 instup.exe Token: 32 3440 instup.exe Token: SeDebugPrivilege 1432 instup.exe Token: 32 1432 instup.exe Token: SeDebugPrivilege 788 aswOfferTool.exe Token: SeImpersonatePrivilege 788 aswOfferTool.exe Token: SeDebugPrivilege 444 aswOfferTool.exe Token: SeImpersonatePrivilege 444 aswOfferTool.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: 35 1432 instup.exe Token: SeRestorePrivilege 1432 instup.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exeinstup.exepid Process 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
msedge.exeinstup.exepid Process 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1400 msedge.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe 1432 instup.exe -
Suspicious use of SetWindowsHookEx 54 IoCs
Processes:
avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeaswOfferTool.exesecurebrowser_setup.exeAvastBrowserUpdateSetup.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdateComRegisterShell64.exeAvastBrowserUpdate.exeAvastBrowserUpdate.exesetup.exesetup.exeAvEmUpdate.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeAvastNM.exeSetupInf.exeoverseer.exeengsup.exeavDump.exeengsup.exeAvastUI.exeMiniSearchHost.exeAvastUI.exeAvastUI.exeAvastUI.exeAvastUI.exeAvastUI.exemsedge.exeAvastUI.exeAvastUI.exePickerHost.exepid Process 4908 avast_free_antivirus_setup_online.exe 2172 avast_free_antivirus_setup_online_x64.exe 3440 instup.exe 3440 instup.exe 1432 instup.exe 1432 instup.exe 4700 aswOfferTool.exe 5116 aswOfferTool.exe 580 aswOfferTool.exe 788 aswOfferTool.exe 444 aswOfferTool.exe 4724 aswOfferTool.exe 1432 instup.exe 2768 sbr.exe 11272 SetupInf.exe 11324 SetupInf.exe 11356 SetupInf.exe 11396 SetupInf.exe 11436 SetupInf.exe 11476 aswOfferTool.exe 11512 securebrowser_setup.exe 11928 AvastBrowserUpdateSetup.exe 5640 AvastBrowserUpdate.exe 8420 AvastBrowserUpdate.exe 8504 AvastBrowserUpdate.exe 8452 AvastBrowserUpdateComRegisterShell64.exe 8160 AvastBrowserUpdateComRegisterShell64.exe 8520 AvastBrowserUpdateComRegisterShell64.exe 8572 AvastBrowserUpdate.exe 8588 AvastBrowserUpdate.exe 8312 setup.exe 8340 setup.exe 13072 AvEmUpdate.exe 8016 AvEmUpdate.exe 7608 RegSvr.exe 5392 RegSvr.exe 7688 AvastNM.exe 7724 SetupInf.exe 7804 overseer.exe 4172 engsup.exe 12136 avDump.exe 10732 engsup.exe 11452 AvastUI.exe 4984 MiniSearchHost.exe 9520 AvastUI.exe 10440 AvastUI.exe 7368 AvastUI.exe 7376 AvastUI.exe 10900 AvastUI.exe 1400 msedge.exe 1400 msedge.exe 9324 AvastUI.exe 2108 AvastUI.exe 10272 PickerHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 1400 wrote to memory of 3372 1400 msedge.exe 81 PID 1400 wrote to memory of 3372 1400 msedge.exe 81 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4736 1400 msedge.exe 82 PID 1400 wrote to memory of 4796 1400 msedge.exe 83 PID 1400 wrote to memory of 4796 1400 msedge.exe 83 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 PID 1400 wrote to memory of 4748 1400 msedge.exe 84 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bullet4life1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb269d3cb8,0x7ffb269d3cc8,0x7ffb269d3cd82⤵PID:3372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1856 /prefetch:22⤵PID:4736
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:82⤵PID:4748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:2428
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:12⤵PID:4208
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:12⤵PID:2804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:12⤵PID:2148
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:12⤵PID:3504
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:12⤵PID:3744
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:1876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:1528
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5260 /prefetch:82⤵PID:2572
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5084 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:12⤵PID:4328
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:12⤵PID:2784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2552 /prefetch:12⤵PID:4020
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:12⤵PID:4604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:12⤵PID:3092
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵PID:4580
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2524 /prefetch:12⤵PID:2964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:12⤵PID:4308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:12⤵PID:3488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:12⤵PID:2056
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:12⤵PID:4492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6752 /prefetch:12⤵PID:1784
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6988 /prefetch:82⤵PID:1868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1900,14212767886958716085,1086583007077938247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6684 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2452
-
-
C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4908 -
C:\Windows\Temp\asw.460ebba7a051f3f6\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.460ebba7a051f3f6\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_ava_tst_007_402_c:dlid_FAV-PPC /ga_clientid:9552175f-bebd-46ee-a9fd-0152aa82f691 /edat_dir:C:\Windows\Temp\asw.460ebba7a051f3f6 /geo:GB3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2172 -
C:\Windows\Temp\asw.38a4aa423719cf50\instup.exe"C:\Windows\Temp\asw.38a4aa423719cf50\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.38a4aa423719cf50 /edition:1 /prod:ais /stub_context:ba8caa7c-77a2-4d21-b1d2-efb610f40464:9931880 /guid:1857f018-333a-435c-9813-0632c575104e /ga_clientid:9552175f-bebd-46ee-a9fd-0152aa82f691 /no_delayed_installation /cookie:mmm_ava_tst_007_402_c:dlid_FAV-PPC /ga_clientid:9552175f-bebd-46ee-a9fd-0152aa82f691 /edat_dir:C:\Windows\Temp\asw.460ebba7a051f3f6 /geo:GB4⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3440 -
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\instup.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.38a4aa423719cf50 /edition:1 /prod:ais /stub_context:ba8caa7c-77a2-4d21-b1d2-efb610f40464:9931880 /guid:1857f018-333a-435c-9813-0632c575104e /ga_clientid:9552175f-bebd-46ee-a9fd-0152aa82f691 /no_delayed_installation /cookie:mmm_ava_tst_007_402_c:dlid_FAV-PPC /edat_dir:C:\Windows\Temp\asw.460ebba7a051f3f6 /geo:GB /online_installer5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1432 -
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" -checkGToolbar -elevated6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4700
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" /check_secure_browser6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5116
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:580
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:788 -
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3252
-
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:444 -
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2340
-
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" -checkChrome -elevated6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4724
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\sbr.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\sbr.exe" 1432 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2768
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11272
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11324
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11356
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11396
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:11436
-
-
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\aswOfferTool.exe" /install_secure_browser /brandcode:102 /cmd:"/make_default /language=en-US" /config_def:C:\Windows\Temp\asw.38a4aa423719cf50\config.def6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:11476 -
C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\securebrowser_setup.exe"C:\Windows\Temp\asw.38a4aa423719cf50\New_180717ec\securebrowser_setup.exe" /s /run_source=av_install /make_default /language=en-US7⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:11512 -
C:\Users\Admin\AppData\Local\Temp\nss790C.tmp\AvastBrowserUpdateSetup.exeAvastBrowserUpdateSetup.exe /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"8⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:11928 -
C:\Program Files (x86)\GUM8222.tmp\AvastBrowserUpdate.exe"C:\Program Files (x86)\GUM8222.tmp\AvastBrowserUpdate.exe" /silent /install "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies"9⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5640 -
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regsvc10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8420
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /regserver10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8504 -
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8452
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8160
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\1.8.1697.6\AvastBrowserUpdateComRegisterShell64.exe"11⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:8520
-
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezZEMzdDNzYwLThGRUQtNDhBNS1BNEE0LUNFQzA5NUIyRDhERH0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5Ny42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5Ny42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezREOUVEOEM4LUZENzAtNEZDNC05MTJGLUNFOEVCNjYwREI5Rn0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9IntBOUE0QTc0Ri0xQUMyLTQyQzYtOEEyRS1DQzRFQ0M4NDgwMkR9IiB1c2VyaWRfZGF0ZT0iMjAyNDA4MDMiIG1hY2hpbmVpZD0iezAwMDBDQkM0LUFBNTMtOTMyRC1GNjQ2LTgzNTZEQzZDRUMyNH0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDgwMyIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins3N0IyREMzRS01RjIwLTQ5RTItQkFDOC01NDRCMTBBNEFGMUV9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMjIwMDAuNDkzIiBzcD0iIiBhcmNoPSJ4NjQiLz48YXBwIGFwcGlkPSJ7NkQzN0M3NjAtOEZFRC00OEE1LUE0QTQtQ0VDMDk1QjJEOEREfSIgdmVyc2lvbj0iIiBuZXh0dmVyc2lvbj0iMS44LjE2OTcuNiIgbGFuZz0iZW4tVVMiIGJyYW5kPSIzNjAyIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIzNDQiLz48L2FwcD48L3JlcXVlc3Q-10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of SetWindowsHookEx
PID:8572
-
-
C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe"C:\Program Files (x86)\AVAST Software\Browser\Update\AvastBrowserUpdate.exe" /handoff "bundlename=Avast Secure Browser&appguid={A8504530-742B-42BC-895D-2BAD6406F698}&appname=Avast Secure Browser&needsadmin=true&lang=en-US&brand=3602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dmsedge --import-cookies" /installsource otherinstallcmd /sessionid "{4D9ED8C8-FD70-4FC4-912F-CE8EB660DB9F}" /silent10⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:8588
-
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --heartbeat --install --create-profile8⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:9288 -
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25735.183 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb109e0c80,0x7ffb109e0c8c,0x7ffb109e0c989⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9304
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2148,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:29⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9532
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1828,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:119⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9540
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2392,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:139⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9604
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=2888,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:19⤵
- Executes dropped EXE
PID:9888
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3488,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:99⤵
- Executes dropped EXE
PID:9916
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=3744,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:149⤵
- Executes dropped EXE
PID:9928
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3792,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:99⤵
- Executes dropped EXE
PID:9936
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4476,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:149⤵
- Executes dropped EXE
PID:9104
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4736,i,14792407182197135937,5929973959123067062,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:149⤵
- Executes dropped EXE
PID:10312
-
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exeAvastBrowser.exe --silent-launch8⤵
- Executes dropped EXE
- Adds Run key to start application
- Writes to the Master Boot Record (MBR)
- Checks system information in the registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:12520 -
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\AVAST Software\Browser\User Data" --url=fake_url --annotation=plat=Win64 --annotation=prod=Avast --annotation=ver=126.0.25735.183 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb109e0c80,0x7ffb109e0c8c,0x7ffb109e0c989⤵
- Executes dropped EXE
PID:12544
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1956,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:29⤵
- Executes dropped EXE
PID:12744
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=2228,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:119⤵
- Executes dropped EXE
PID:12764
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2348,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:139⤵
- Executes dropped EXE
PID:12836
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3568,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:149⤵
- Executes dropped EXE
PID:13188
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3364,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:149⤵
- Executes dropped EXE
PID:13296
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3644,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:149⤵
- Executes dropped EXE
PID:11160
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3672,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:149⤵
- Executes dropped EXE
PID:11212
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3860,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:149⤵
- Executes dropped EXE
PID:7992
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3728,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:149⤵
- Executes dropped EXE
PID:1732
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3716,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:149⤵
- Executes dropped EXE
PID:3364
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3692,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:149⤵
- Executes dropped EXE
PID:3192
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4192,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:149⤵
- Executes dropped EXE
PID:8976
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3884,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:149⤵PID:6572
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3408,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:149⤵PID:6648
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4364,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:149⤵PID:7400
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4544,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:149⤵PID:11604
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=3904,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4704 /prefetch:149⤵PID:11628
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4864,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:149⤵PID:8516
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5016,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:149⤵PID:8856
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5200,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:149⤵PID:9600
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4848,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=3980 /prefetch:149⤵PID:10372
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5564,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:149⤵PID:9896
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --field-trial-handle=5588,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:19⤵PID:10448
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=renderer --extension-process --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --field-trial-handle=5596,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:99⤵PID:10456
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4368,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:149⤵PID:6072
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5020,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:149⤵PID:6904
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=5196,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:149⤵PID:6968
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6672,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:149⤵PID:9352
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=4852,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:149⤵PID:12988
-
-
C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe"C:\Program Files\AVAST Software\Browser\Application\AvastBrowser.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=6828,i,14312215758503504501,5669121200293701281,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:149⤵PID:13076
-
-
-
-
-
-
-
-