Analysis
-
max time kernel
70s -
max time network
93s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05-08-2024 23:48
Static task
static1
Behavioral task
behavioral1
Sample
Purge_WB.bat
Resource
win11-20240802-en
General
-
Target
Purge_WB.bat
-
Size
5KB
-
MD5
895acbc5a11a2878f9f1be4d6fbde662
-
SHA1
41d41071a821dc4b1ada2941955e561bae8d27b4
-
SHA256
0da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9
-
SHA512
3ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6
-
SSDEEP
96:GeI8huOXdzgWE9BrY7Tof33UHL7ZDgCOw/OW8z7J124JJYiAnrT8EMJ124J1:GeIuFi/iTof33UHBgWu7KekTLMKe1
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 4 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
explorer.exeexplorer.exedescription ioc process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Drops file in Windows directory 4 IoCs
Processes:
chrome.exesetup.exesetup.exedescription ioc process File opened for modification C:\Windows\SystemTemp chrome.exe File opened for modification C:\Windows\SystemTemp setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\metadata setup.exe File opened for modification C:\Windows\SystemTemp\Crashpad\settings.dat setup.exe -
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
explorer.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe -
Enumerates system info in registry 2 TTPs 7 IoCs
Processes:
chrome.exeSearchHost.exeSearchHost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 4248 taskkill.exe 5720 taskkill.exe -
Processes:
explorer.exeSearchHost.exeSearchHost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" explorer.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
chrome.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673753777529156" chrome.exe -
Modifies registry class 64 IoCs
Processes:
SearchHost.exeexplorer.exeSearchHost.exeexplorer.exeStartMenuExperienceHost.exeStartMenuExperienceHost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "14795" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "13309" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\PastIconsStream = 1400000005000000010001000200000014000000494c2006020004002c0010001000ffffffff2110ffffffffffffffff424d360000000000000036000000280000001000000040000000010020000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000ff00000060000000000000000000000020000000b0000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff000000ff00000060000000200000000000000020000000f00d0d0df09d9d9dffc8c8c8ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff000000603f3f3f66000000ff00000060000000900a0a0af0c0c0c0ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660e2e2e2ff474747eb000000d0000000e04c4c4cee999999ff939393eeb1b1b1f0e0e0e0ffe5e5e5ffe5e5e5ff8f8f8fff000000ff0000006056565660c8c8c8f7adadadf6858585ff000000ff000000ff737373ff999999ff999999ff999999ff999999ffa0a0a0e8868686ff000000ff000000606d6d6d88aaaaaaebb2b2b2ffb2b2b2ff7a7a7aff000000ff000000ff696969ff999999ff999999ff999999ff999999ff5f5f5fff000000ff0000006045454571b2b2b2ffb2b2b2ffb2b2b2ffa7a7a7ff1b1b1be8000000c0000000b0080808f08f8f8fff999999ff999999ff5f5f5fff000000ff00000060303030607f7f7fff7b7b7bf67e7e7ee2525252e20a0a0af0000000f00000003000000020000000f0101010eb5a5a5af6505050ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff676767ff000000ff000000b000000020000000000000000000000020000000b0000000ff000000ff00000060303030607f7f7fff7f7f7fff7f7f7fff777777ff080808f0000000d0000000000000000000000000000000000000000000000060000000ff00000060000000602c2c2ceb5f5f5fff5f5f5fff3f3f3fee080808f0000000f0000000300000000000000000000000000000000000000000000000a0000000600000000000000050000000b0000000f0000000ff000000f0000000a000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000424d3e000000000000003e0000002800000010000000400000000100010000000000000100000000000000000000000000000000000000000000ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff0000ffff0000fff90000fff10000800100000000000000000000000000000000000000000000000000000001000080070000c0070000c80f0000ffff0000ffff000000000000000000000000000000000000000000000000010000000800000002000000040000002400000001000000000000000100000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1022" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{83A30479-B60B-4520-95C8-7CAE5DE34E33} explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}" explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHost = 6801000088020000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1022" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295" explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\ explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Vid = "{137E7700-3573-11CF-AE69-08002B2E1262}" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13309" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1055" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "133670855649585230" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "14795" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8300" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616209" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16" explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "13309" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 840031000000000005594abe1100444f574e4c4f7e3100006c0009000400efbe0259697a05594abe2e000000655702000000010000000000000000004200000000007cf1f60044006f0077006e006c006f00610064007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100370039003800000018000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Rev = "0" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193" explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1055" SearchHost.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070800420061007200510065007600690072000a0041006200670020006600760074006100720071002000760061000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000dbeb8b4efe4da0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4" explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259} explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295" explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\MuiCache SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-131918955-2378418313-883382443-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe -
NTFS ADS 2 IoCs
Processes:
chrome.exeexplorer.exedescription ioc process File opened for modification C:\Users\Admin\Downloads\Purge_WB.zip:Zone.Identifier chrome.exe File opened for modification C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat:Zone.Identifier explorer.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
explorer.exepid process 236 explorer.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
explorer.exechrome.exeexplorer.exepid process 236 explorer.exe 236 explorer.exe 2292 chrome.exe 2292 chrome.exe 5912 explorer.exe 5912 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 236 explorer.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs
Processes:
chrome.exepid process 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
taskkill.exeexplorer.exechrome.exedescription pid process Token: SeDebugPrivilege 4248 taskkill.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 2292 chrome.exe Token: SeCreatePagefilePrivilege 2292 chrome.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 236 explorer.exe Token: SeCreatePagefilePrivilege 236 explorer.exe Token: SeShutdownPrivilege 2292 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
explorer.exechrome.exepid process 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe 2292 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
explorer.exepid process 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe 236 explorer.exe -
Suspicious use of SetWindowsHookEx 9 IoCs
Processes:
explorer.exeSearchHost.exeStartMenuExperienceHost.exeexplorer.exeSearchHost.exeStartMenuExperienceHost.exepid process 236 explorer.exe 2788 SearchHost.exe 3992 StartMenuExperienceHost.exe 236 explorer.exe 236 explorer.exe 5912 explorer.exe 5260 SearchHost.exe 6136 StartMenuExperienceHost.exe 5912 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
cmd.exeexplorer.exechrome.exedescription pid process target process PID 880 wrote to memory of 4512 880 cmd.exe cacls.exe PID 880 wrote to memory of 4512 880 cmd.exe cacls.exe PID 880 wrote to memory of 4248 880 cmd.exe taskkill.exe PID 880 wrote to memory of 4248 880 cmd.exe taskkill.exe PID 880 wrote to memory of 4832 880 cmd.exe reg.exe PID 880 wrote to memory of 4832 880 cmd.exe reg.exe PID 880 wrote to memory of 2828 880 cmd.exe reg.exe PID 880 wrote to memory of 2828 880 cmd.exe reg.exe PID 880 wrote to memory of 3108 880 cmd.exe reg.exe PID 880 wrote to memory of 3108 880 cmd.exe reg.exe PID 880 wrote to memory of 2268 880 cmd.exe reg.exe PID 880 wrote to memory of 2268 880 cmd.exe reg.exe PID 880 wrote to memory of 3076 880 cmd.exe reg.exe PID 880 wrote to memory of 3076 880 cmd.exe reg.exe PID 880 wrote to memory of 960 880 cmd.exe reg.exe PID 880 wrote to memory of 960 880 cmd.exe reg.exe PID 880 wrote to memory of 224 880 cmd.exe reg.exe PID 880 wrote to memory of 224 880 cmd.exe reg.exe PID 880 wrote to memory of 236 880 cmd.exe explorer.exe PID 880 wrote to memory of 236 880 cmd.exe explorer.exe PID 236 wrote to memory of 2292 236 explorer.exe chrome.exe PID 236 wrote to memory of 2292 236 explorer.exe chrome.exe PID 2292 wrote to memory of 1604 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 1604 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 3848 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4188 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4188 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe PID 2292 wrote to memory of 4212 2292 chrome.exe chrome.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Purge_WB.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:880 -
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵PID:4512
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4248 -
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\WbaFile2⤵PID:4832
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds2⤵PID:2828
-
C:\Windows\system32\reg.exereg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds2⤵PID:3108
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds2⤵PID:2268
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds2⤵PID:3076
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds2⤵PID:960
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds2⤵PID:224
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:236 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"3⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2292 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39dccc40,0x7ffd39dccc4c,0x7ffd39dccc584⤵PID:1604
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1944 /prefetch:24⤵PID:3848
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1712,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2072 /prefetch:34⤵PID:4188
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2252 /prefetch:84⤵PID:4212
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3100 /prefetch:14⤵PID:4184
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3140 /prefetch:14⤵PID:5052
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4456,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4460 /prefetch:14⤵PID:1772
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4776 /prefetch:84⤵PID:3820
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4784,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4800 /prefetch:84⤵PID:4056
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --reenable-autoupdates --system-level4⤵
- Drops file in Windows directory
PID:3416 -
C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x244,0x248,0x24c,0x220,0x250,0x7ff744f04698,0x7ff744f046a4,0x7ff744f046b05⤵
- Drops file in Windows directory
PID:2996 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5100,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5108 /prefetch:14⤵PID:1616
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3376,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3356 /prefetch:84⤵PID:3260
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3372,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4796 /prefetch:14⤵PID:2284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3208,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:84⤵PID:1592
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3196,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3224 /prefetch:84⤵PID:3900
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --field-trial-handle=3176,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3188 /prefetch:14⤵PID:4904
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --field-trial-handle=3156,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5172 /prefetch:14⤵PID:1484
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --field-trial-handle=5180,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=212 /prefetch:14⤵PID:3004
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --field-trial-handle=3288,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5128 /prefetch:14⤵PID:4948
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --field-trial-handle=3092,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5036 /prefetch:14⤵PID:1588
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=5820,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5776 /prefetch:14⤵PID:5876
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=5768,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5780 /prefetch:14⤵PID:5204
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5744,i,15629507842644884609,90418342852217471,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5808 /prefetch:84⤵
- NTFS ADS
PID:5280 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat" "3⤵PID:5660
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"4⤵PID:5696
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
PID:5720 -
C:\Windows\system32\reg.exereg query HKEY_CLASSES_ROOT\WbaFile4⤵PID:5760
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds4⤵PID:5824
-
C:\Windows\system32\reg.exereg query HKEY_CURRENT_USER\Software\Stardock\WindowBlinds4⤵PID:5840
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\ObjectDesktop\WindowBlinds4⤵PID:5864
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Stardock\WindowBlinds4⤵PID:5816
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Wow6432Node\Stardock\WindowBlinds4⤵PID:5896
-
C:\Windows\system32\reg.exereg query HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Uninstall\WindowBlinds4⤵PID:6084
-
C:\Windows\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:5912
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3992
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2788
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1324
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5340
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5260
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\Application\SetupMetrics\20240805234938.pmaFilesize
520B
MD5d7bdecbddac6262e516e22a4d6f24f0b
SHA11a633ee43641fa78fbe959d13fa18654fd4a90be
SHA256db3be7c6d81b2387c39b32d15c096173022cccee1015571dd3e09f2a69b508a9
SHA5121e72db18de776fe264db3052ce9a842c9766a720a9119fc6605f795c36d4c7bf8f77680c5564f36e591368ccd354104a7412f267c4157f04c4926bce51aeeaa1
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1Filesize
264KB
MD5ef3e8d9a40e77376e9b0d374609ee271
SHA1e65c15e26af50e35d3863be3ac9fbcc0a14eb1ca
SHA256c94ce647a66d7cf1afa94e0df31e5af1f8200f6cdd2a69ff983f42551764e616
SHA512de4612520714182fdc1132626fae1f738c971c7c0ac2e74a26dafe2eab02c47b98f74b2825b4f27cccc40a334c4d7b605152e8a2cc97d94103111ba2b5283968
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent StateFilesize
6KB
MD515e818d6fb6fa34107003ebefc666b4a
SHA1812b786731f4a81168208c68ed45a929a91e3a4c
SHA256a5b37b7d0b78f5c0df0be4da0bc6c1a5d90bc5699797081b3c6738097a5f6ca2
SHA51255bf2d8efed4849b2534c05de1ee962116a9ea0d0f789860fc23f95ab71822426a37d45dfc315146d448b087734b298470a9aa781365cc6df8afe58dba3b3206
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending ReportsFilesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
692B
MD5c6fd062c10309c1f33adf0008ec89b08
SHA1ac8e24a1780a73033b93c52702b05437888ec6ba
SHA256d998fda1ce0d1bb8bc3373f63d71261ea26531afdf1d8f5fa678b88c3d57bfa6
SHA51225a505f977a8470723103396b91eb4f61762c550f1b92cc19b762832799571d1a7b95b13a1302e95edf3049a1aefe5138801bae16e5f200e5157ebd36fd404b8
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD539567d6bef87030e8db0e24ed234d90c
SHA144863178ce4a45d726581b6bd2514c1655cc770b
SHA256167765fe10e5679e741eb624d1aa33a09bd5e639e348964848bb7ebe2f1b700a
SHA51216c0a27274ec888f3d96d8d4daaaa05bc12e77bb6a0fc5edc3363ae11ada9aacbb47f5f65eb566df0c08f272f1aacb4f7382edc14b4efb69b24a10170d366ff6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
1KB
MD51b332ab8e49cf6dd01757c798f50f53b
SHA1ac5ba14140e4667b363e025ebf9f84de9a8ab488
SHA25695d5ac35acb61f09f00dcfc680ad8a0ca2581616d954d87b3f624472eba8b97b
SHA5125bfee669d1387f2d97c30d5f496f0293a60eead00d6e5866623cd0f4f11039a0d332ba8a290b7710b0b3aed17640bdde3dbf32d914a293ba382bbf3820e55f7c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD5afc15546b52ddabcbdc461297bbf0ba2
SHA1300319fa0419b02ed310922b6d750684cb3d3e53
SHA256ce0fd00c34ac0245c37455433394875df128eb858cff5348da2aff99f1f1f5c8
SHA512f4c1e4329e0c22106b829d00325bf27eb19b4bb2721d0ceecc0d869c70f5df2867e2f0b63b622e91d7faa0ce9e15084e0af28a57e5eb61dbcf16e3b752543b47
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurityFilesize
2KB
MD593ff36d33834e8bb0cbb66fa2eb8aa63
SHA16381be01a0a487a249e08a9af8c4ba788e2541a5
SHA2560f28785fcef041cb089db16443b149edf5b0142d8f271d25aafd3eb2a18c4568
SHA51207dc6a867fda45e0eb5ca834a6d2a8d97f715157fd8468971b5dd950192f637875eabd31cbcee523a4a09596b63c3aff8befcb230f7b4e9a1147fc7bb4af2b36
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD51ea547467c2b8a1ee436eb75211c7879
SHA139672312cc90d5f5314b7b0f7e29b1d328cd7698
SHA256ebc5861754faefc6bf1938c60bef7262294e2df605c66603790af7a7128d7595
SHA512e800511c8282b64b460f6e1abf08b00d742e0f80dabaa5d15561c3f82ee7a5653fef68a4d4e960f34cdcf604ef2b3e4bc7667b9b5950701167746792d5e3ed61
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5a57d1ce6417f359c96eaa589084404b5
SHA1aaa8291f403af7dc63bfb64232f71891f226e3e5
SHA25658f1a8d3da1ffc329526e84b25d1722c4f6f0815055b0ed0ef6ce4f5cb6ad809
SHA51249c50ad58be7b38c1640b5a074dc665ee33e911ceedadb89a96f020c4e0510f515d1bdebf492105a522aa9d64f5d9d417d2850910dcf26b1470eb4b0902fc605
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD525c4f571307f7f9b94b05a22624cc490
SHA1d596a06f5f44829aed27543148754e62ea0e6c8d
SHA25681ce115384ab3ebd2ee1620b6adb4e6b0839b661ae651d400886c7121f509f21
SHA512d6adda9e311ee01ad29441aa022a604a49ded69c621ebd0e4a1a1d84ca69ad679722a73a17410492c6eb7443c03f463c5026e6afa70a6e56a9e6d240bf16c33c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD588727201b7ae6e00608146ae70736e35
SHA1d9a20df2bb8305aab019a9ede1184ab7985c4b69
SHA25611047ee02aad84a326ed63b474fbd7c00e745ea7eeb876af85bc55c7a2a6521d
SHA5129c1bba3829e9dbe55db4ccd62b87a897a23053b58cc63c715bf7fbe61d07a1001b28eb3c963b816295e96ac559137d99bd0c679f85f9fd42c4169811a42ba37b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5f5fa6c1e4997c0772706d36fbe892536
SHA1b6515e826a1689fa1b908cd4e58a18501fe353b5
SHA2568670d9bcd610315d628a921a1e2958985a73a137ed20e39f8c9d9cbd9c397b27
SHA512a1b711620bcdfd066c797aaa9a709ce861138fa8c21580387aa8d3f89059e564a6c1589a27f8f7043c8b9046c7b5aa210c6411ff73087d8d6942b6779c0cbd41
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
8KB
MD533cf6e0ce6c6e90c71d4326cdc290bed
SHA1770544e17fbff129b1a3892a494137cfd6f210cf
SHA2567381b6adddef798b9b2b00efa049ac18b7cb6b53b4f43e875adaa8b275f83be3
SHA512a268d750185c498c3cf9ae7bff52fe25a80c4fa3d90c3b043ccc1aa3ee3ee9d4bcff2cb915f113c116bfc67d90764f75cf5c3a17f432b82b232fcda9f129c439
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
15KB
MD5d4c6cc257528f7cbeb7127755a6feb22
SHA14c1af569f99467fe254561511799eb989568ffcc
SHA256eccf053bac044c17038b9e101841f63455e6d375d027fb773817179f0750e1b3
SHA512ea9c120aec5e0d5d7c06a43c216ae51fe4786394f9c78e1f7a1593802c1574d7cff30ede0602cead734b19fa52af3910f7384e45170dca9d6afff97df44ad905
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
197KB
MD5a154caca2c6847aa3fad7fe9a50f9ca6
SHA1e541f4e835589e17d9163b56f553b0e4e7e0fcb8
SHA256c97908a43cbbe86d7be5e8665dfa5d9a9b06ff72876bebe46242e6d29f1cd00e
SHA512821fbc15ccc4dc4a570f43b94a5fd83f6479c598d0fbb1e187dfb1253d314f203abe20f4ceacc12b76f1f0ccd40136c8736cb77ba7801c0886eb7b3ac70ded0d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
197KB
MD5869c6b96622304e70905b3857e908e23
SHA11fe749319e9fe81ff41f2f0efd06131f2ee89718
SHA2567aee60056fda86bf0860e519011ff7d52b1d31ab7f76be776fa7d3a8da8b8430
SHA512b7827c882faa407203b9cb0c18c5045e95ccc34ef0de88ecf5fe65be57ba6daf1c78be22bb6c72fc433d4eded9ce922c33a1e90aaef925947727896df9c10756
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
101KB
MD599066f5df84e651c7ee0498aa5e1097f
SHA1a9ba4b657fe66f12593f7b129768d87ddd2ac07c
SHA2562e350386cdc7c303d821927adbf3e5eb01432817901e90d7c1e508c1c860053f
SHA512e40ae881f776952a301d7ce32aa1012abae069210f393b716d1fd65ea5e1effd44581bd8fc1dc0e24980e7f2c947516ba8f80cffc50248939f4a854f9f20e94c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local StateFilesize
287KB
MD5d983bed6c600e8e50fa06e591f228ddc
SHA14f906f05ae16612955721f05e07e333ed6f1c55d
SHA25637120993e663b0e27dd3e0ffc7a441a5443f5d24b61116b8840dd25ebf3ea373
SHA512aa1c0daf26de64c3d8309aaf3710b131071c4c4fc2d56c1995a845b0992d9bd2de37fa81c9e3882f9eb25b2c1c1796101842a249384a85eae3a692647db5fc9f
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\LocalState\start.binFilesize
4KB
MD5bafd74ed1605d515ba05b9ea9a1c6cd7
SHA1124014fcdfca21f1b942315ab179deadf06bc9da
SHA25671cefeeee4370273e730725e67347924c1a016c72cd47508838309aa2333fbfb
SHA512f89bc412a7a0393d5a23ade660e02a52da7a288ecbd0a01798bf90286dc8cfe3ac9f690111a26e8df9f0f1d876f6dbfd688261d9d4e056be659e315a70d27f55
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xmlFilesize
2KB
MD577b29acd295aa611e03e49dd87e829d2
SHA1529dae893598ea58dccb591aeabd937dd9554d72
SHA2566ec599714a7303b5fde1eb55e6a1472b46475ad01ec0ea5ae65aedaa38b07206
SHA512cde26660015318ccb6e8d360c7650d5fb0daa5f3513b98efede3124c35013411c8ddbcbbe0d3bbfd0a204f4d60823b63d959ebf3470db17181fd088390387a2f
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\FZDB0V8H\www.bing[1].xmlFilesize
17KB
MD522d1833194d45d8cb0f0c4d5cf1645da
SHA14df02cdd467da98d0c714098e5df4c67ac6c55e4
SHA256f413fbcb82c421cb203aa5d63e1b4b5cbf6049699a36962567ede83f7e86c848
SHA5125619bd777cb947665afdb7bbe354f2578308565716eea1521153a0ea52b9acb442225347819bd601abd80de06719f564fadf75557b736a8d21db0a44e051cb0a
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.bytecodeFilesize
66KB
MD5eed23559fd6dfe521c0d7642ce02b78e
SHA161aa4145d7136ce3321bcc4ef9260f68d75aee96
SHA25630793a6c30fcac6c7b2748526ec2d2b62a437c01e4bdf9c77f76ccf349f69efc
SHA5120029277e3148b5c00db914c88ed76bb5c4fb55c8c91a49f103f80275fac180037b47f40629706062f37f5c2003f3414caf88489ffa946126bce377dcf7f348da
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\ServiceWorkerFiles\3FC3D503-2F49-473F-83BD-86303CA816B2\Zrtu2hQ08VU_1.metadataFilesize
192B
MD5b02b06d99239c597c75c2bb097e24adf
SHA1141ab6a075a66f2f7fefe739c12f0c477e0bc59c
SHA256e0cc2f30c00d7a50c77bc51cfe4da8a7c1731aaf83b243ea966c7a8668d43571
SHA512c4cddbb087c002bdcbfc47d3ae0cf699f6799d84c05e3a52ab75a045ce117b7c5a81bb10ef022a9260b97b4fe89d42f2935160b45e7a044b83a36ed149668974
-
C:\Users\Admin\AppData\Local\Packages\microsoftwindows.client.cbs_cw5n1h2txyewy\AC\INetCache\FCK5ZBL7\tbcpdb4ILy50_OshQSeODT5Jq0w[1].cssFilesize
963KB
MD5140bd8a4e4ba2aeb930724ea8fac4d24
SHA13be1f83fed8e3f7cd1e76b6ba4bb4c66fa6e879e
SHA2563dad3aecbd010b477e7d19fbaf12785ccc1e50f0b03d786770aa0b227c6f358c
SHA5129a10fa00ad62d2da1acc7dbabae583e3c7c9f4e6d068974154f7f0c8ff94f74b609447086515028d7ecc031e1439fc17f24528f2f2833e365a572875c7e9a2c6
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.batFilesize
5KB
MD5895acbc5a11a2878f9f1be4d6fbde662
SHA141d41071a821dc4b1ada2941955e561bae8d27b4
SHA2560da884ddad29cf36f90783a57b2587a8178b3a0f4ea2249f9b14b83e5ba62df9
SHA5123ec78748bd628b55b82d57282f4261dba52b8dbb7ea15d2b281346bef967154c0d05c0854289acb0c900f47007b8f39f6934d59b4bf6b0b73f7a333505c63dd6
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Purge_WB.zip\Purge_WB.bat:Zone.IdentifierFilesize
77B
MD5d9b15d1bc83de68c844627d1e0c63abb
SHA1906160db1f883f95cf79a7cdfac9c4b5271636ea
SHA2569ef82d1ec454b2ca7975c287df12e72eaf49050d371315877a09694407c02835
SHA5125e0ce22dd855033ef55e6b1e5119ca3d327b82a9775ebcc8f8ed86ab4e5e768a7b44e71480cf5813e160c5b7be2db48261b15c0fce6737223af4e4300e9f7ae3
-
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dicFilesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
-
C:\Users\Admin\Downloads\Purge_WB.zipFilesize
1KB
MD5ba32afd7afaa81df73d9e926d4b0acd3
SHA1dae1e4d7c2428f3b315693a810e539fe917d96cd
SHA256533e2d4bbf6a7a42fa163142306ac9d702df7ac401db69ff5e6334f9710b1b55
SHA512566eeb9e26567cada1a1d79d192ece2b0891117b58e17b7fa0d84158ba85954b4609b1c73fd209574cefb78432ef5cf3b542b1f7686536c131d1a96a39def505
-
C:\Users\Admin\Downloads\Purge_WB.zip:Zone.IdentifierFilesize
130B
MD5e8278e46f837cefca4746751023d90d4
SHA1dfb1d1d83effe8be9350bd7b72714076f4cdd8cc
SHA256a15dd676d7cbb7b9762683f2a66bd800b6f563ee65bbe24eb35e550dfc8cfa07
SHA5120ffc828505dd21c21a47779d268687df7766876321d679dc9db5b1b3028d54c4ab71dc64e81b989fd4866be5852c1969866b05666d9befd5d350bed912733add
-
\??\pipe\crashpad_2292_VWNDVDESZEIVXPIGMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/2788-172-0x000001B83CC30000-0x000001B83CD30000-memory.dmpFilesize
1024KB
-
memory/2788-27-0x000001B828000000-0x000001B828100000-memory.dmpFilesize
1024KB
-
memory/2788-9-0x000001B806000000-0x000001B806100000-memory.dmpFilesize
1024KB
-
memory/2788-44-0x000001B839020000-0x000001B839040000-memory.dmpFilesize
128KB
-
memory/2788-70-0x000001B8393E0000-0x000001B8394E0000-memory.dmpFilesize
1024KB
-
memory/2788-87-0x000001B828720000-0x000001B828740000-memory.dmpFilesize
128KB
-
memory/2788-88-0x000001B8392C0000-0x000001B8392E0000-memory.dmpFilesize
128KB
-
memory/2788-108-0x000001B839730000-0x000001B839750000-memory.dmpFilesize
128KB
-
memory/5260-1092-0x00000216724D0000-0x00000216725D0000-memory.dmpFilesize
1024KB
-
memory/5260-1223-0x0000021676C90000-0x0000021676D90000-memory.dmpFilesize
1024KB
-
memory/5260-1159-0x00000216738A0000-0x00000216738C0000-memory.dmpFilesize
128KB
-
memory/5260-1139-0x0000021673110000-0x0000021673130000-memory.dmpFilesize
128KB
-
memory/5260-1138-0x0000021672880000-0x00000216728A0000-memory.dmpFilesize
128KB
-
memory/5260-1098-0x0000021673170000-0x0000021673270000-memory.dmpFilesize
1024KB
-
memory/5260-1095-0x0000021672EE0000-0x0000021672F00000-memory.dmpFilesize
128KB
-
memory/5260-1072-0x0000021670100000-0x0000021670200000-memory.dmpFilesize
1024KB