36a9e7f1c95b82ffb99743e0c5c4ce95d83c9a430aac59f84ef3cbfab6145068

Processes:

Explorer.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

Processes:

Explorer.EXE

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "Guest"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE

Drops startup file 2 IoCs

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs
Abuse Rundll32 to proxy execution of malicious code.
defense_evasion

Rundll32
T1218.011

Processes:

rundll32.exe

pid process

2412 rundll32.exe

pid	process
2412	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

sidebar.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sidebar = "C:\\Program Files\\Windows Sidebar\\sidebar.exe /autoRun"	sidebar.exe

Drops desktop.ini file(s) 51 IoCs

Processes:

regsvr32.exeregsvr32.exeExplorer.EXEie4uinit.exemctadmin.exeWinMail.exeWinMail.exeregsvr32.exe

description	ioc	process
File opened for modification	C:\Users\Guest\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Guest\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Favorites\Links for United States\desktop.ini	mctadmin.exe
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Guest\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File created	C:\Users\Guest\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Guest\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-1506706701-1246725540-2219210854-501\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Guest\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 49 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

unregmp2.exeunregmp2.exevds.exe

description	ioc	process
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\E:	vds.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\F:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
bootkit persistence

Bootkit
T1542.003

Processes:

vds.exe

description ioc process

File opened for modification \??\PhysicalDrive0 vds.exe

description	ioc	process
File opened for modification	\??\PhysicalDrive0	vds.exe

Drops file in System32 directory 3 IoCs

Processes:

mmc.exeutilman.exe

description	ioc	process
File opened for modification	C:\Windows\system32\diskmgmt.msc	mmc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_84786F1A8CAA4B4F9826ED02F1DDC631.dat	utilman.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Roaming\Microsoft\Speech\Files\UserLexicons\SP_84786F1A8CAA4B4F9826ED02F1DDC631.dat	utilman.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

regsvr32.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Control Panel\Desktop\Wallpaper = "C:\\Users\\Guest\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Control Panel\Desktop\Wallpaper = "C:\\Users\\Guest\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 1 IoCs

Processes:

ie4uinit.exe

description ioc process

File created C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP ie4uinit.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe

Drops file in Windows directory 10 IoCs

Processes:

DrvInst.exeie4uinit.exerundll32.exechrmstp.exevds.exeExplorer.EXE

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.ev3	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev1	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.ev2	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	chrmstp.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	vds.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Explorer.EXE
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

2520 powershell.exe
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

pid	process
2520	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 17 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

WinMail.exerundll32.exeBCSSync.exeDllHost.execsrss.exeDllHost.exeDllHost.exeDllHost.exeDllHost.exerunonce.exeDllHost.exeDllHost.exeDllHost.exeDllHost.execsrss.exeDllHost.exeDllHost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

runonce.exeExplorer.EXE

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

System Information Discovery

Processes:

csrss.execsrss.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

Processes:

ie4uinit.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

ie4uinit.exeregsvr32.exerundll32.exeregsvr32.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\SQM\InstallDate = "1723285554"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Settings\Anchor Color = "0,0,255"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Khmer UI"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Security	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\20	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\New Windows\UseSecBand = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\12	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\7	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Desktop\General	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\34	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\8	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\35\IEFixedFontName = "Estrangelo Edessa"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\24	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Local Page = "C:\\Windows\\system32\\blank.htm"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\14	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\13	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\25\IEFixedFontName = "MingLiu"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Show_URLinStatusBar = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\6	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\IETld	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Anchor Underline = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\3	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\3\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\33\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Toolbar\ShellBrowser	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\InternetRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\33\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\33	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\NoUpdateCheck = "1"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Services\	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\SOFTWARE\Microsoft\Internet Explorer\Settings	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\GPU	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\39	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Save_Session_History_On_Exit = "no"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Help_Menu_URLs	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\5\IEPropFontName = "Times New Roman"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\30	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\16\IEPropFontName = "Vani"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\18	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\22	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\7\IEFixedFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\8\IEFixedFontName = "Courier New"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\11	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\11\IEPropFontName = "Shonar Bangla"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\32	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Desktop	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\International\Scripts\19	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

Processes:

ie4uinit.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

winlogon.exeDrvInst.exewinlogon.exeutilman.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\Voices	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{1ccc5dc5-4e84-4d09-b338-d79c7699159e}\Attributes	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\CTF\RemoteSession\CLSID	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\Generation = "0"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\DefaultTokenId = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech\\AudioOutput\\TokenEnums\\MMAudioOut\\"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\RemoteSession	winlogon.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\CTF\RemoteSession\KeyboardLayout = "0"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AppLexicons	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\PhoneConverters	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\CLSID = "{C9E37C15-DF92-4727-85D6-72E5EEB6995A}"	utilman.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\CTF\RemoteSession\Profile	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}\Files	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}\Files\Datafile = "%1a%\\Microsoft\\Speech\\Files\\UserLexicons\\SP_84786F1A8CAA4B4F9826ED02F1DDC631.dat"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\AppLexicons	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{1ccc5dc5-4e84-4d09-b338-d79c7699159e}\CLSID = "{A8C680EB-3D32-11D2-9EE7-00C04F797396}"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe

Modifies registry class 64 IoCs

Processes:

unregmp2.exeunregmp2.exeExplorer.EXE

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.au	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.WTV\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\ShellEx\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DVD	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wvx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.adts\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ADTS\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmd\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.AudioCD\Shell\Play\Command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.au\OpenWithProgIds	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0\MRUListEx = ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mov\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpegurl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-ms-wmd	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2v\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ts	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wmv	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2t\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-midi	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\0	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mpg	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wvx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.snd	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpeg\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mpg	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.adts	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-501_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex	unregmp2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeutilman.exe

pid process

2520 powershell.exe
4000 utilman.exe
4000 utilman.exe
Suspicious behavior: GetForegroundWindowSpam 3 IoCs

Processes:

mmc.exesidebar.exeExplorer.EXE

pid process

1644 mmc.exe
636 sidebar.exe
1176 Explorer.EXE

pid	process
2520	powershell.exe
4000	utilman.exe
4000	utilman.exe

pid	process
1644	mmc.exe
636	sidebar.exe
1176	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

powershell.exemmc.exeDrvInst.exeAUDIODG.EXELogonUI.exewinlogon.exeWinMail.exeie4uinit.exerundll32.exeWinMail.exeExplorer.EXE

description	pid	process
Token: SeDebugPrivilege	2520	powershell.exe
Token: 33	1644	mmc.exe
Token: SeIncBasePriorityPrivilege	1644	mmc.exe
Token: 33	1644	mmc.exe
Token: SeIncBasePriorityPrivilege	1644	mmc.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeRestorePrivilege	1728	DrvInst.exe
Token: SeLoadDriverPrivilege	1728	DrvInst.exe
Token: SeLoadDriverPrivilege	1728	DrvInst.exe
Token: 33	2644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2644	AUDIODG.EXE
Token: 33	2644	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2644	AUDIODG.EXE
Token: SeShutdownPrivilege	1240	LogonUI.exe
Token: SeSecurityPrivilege	2980	winlogon.exe
Token: SeBackupPrivilege	2980	winlogon.exe
Token: SeSecurityPrivilege	2980	winlogon.exe
Token: SeTcbPrivilege	2980	winlogon.exe
Token: SeManageVolumePrivilege	2112	WinMail.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2944	ie4uinit.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeRestorePrivilege	2412	rundll32.exe
Token: SeManageVolumePrivilege	2364	WinMail.exe
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE
Token: SeShutdownPrivilege	1176	Explorer.EXE

Suspicious use of FindShellTrayWindow 42 IoCs

Processes:

sidebar.exeExplorer.EXE

pid	process
636	sidebar.exe
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

Explorer.EXE

pid	process
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE

Suspicious use of SetWindowsHookEx 10 IoCs

Processes:

mmc.exeWinMail.exeWinMail.exeExplorer.EXE

pid process

1644 mmc.exe
1644 mmc.exe
1644 mmc.exe
1644 mmc.exe
2112 WinMail.exe
2364 WinMail.exe
1176 Explorer.EXE
1176 Explorer.EXE
1176 Explorer.EXE
1176 Explorer.EXE

pid	process
1644	mmc.exe
1644	mmc.exe
1644	mmc.exe
1644	mmc.exe
2112	WinMail.exe
2364	WinMail.exe
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE
1176	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

csrss.exewinlogon.exeuserinit.exeExplorer.EXEWinMail.exe

description	pid	process	target process
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2980 wrote to memory of 1240	2980	winlogon.exe	LogonUI.exe
PID 2980 wrote to memory of 1240	2980	winlogon.exe	LogonUI.exe
PID 2980 wrote to memory of 1240	2980	winlogon.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 1240	2464	csrss.exe	LogonUI.exe
PID 2464 wrote to memory of 2276	2464	csrss.exe	userinit.exe
PID 2464 wrote to memory of 2276	2464	csrss.exe	userinit.exe
PID 2980 wrote to memory of 2276	2980	winlogon.exe	userinit.exe
PID 2980 wrote to memory of 2276	2980	winlogon.exe	userinit.exe
PID 2980 wrote to memory of 2276	2980	winlogon.exe	userinit.exe
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2276 wrote to memory of 1176	2276	userinit.exe	Explorer.EXE
PID 2276 wrote to memory of 1176	2276	userinit.exe	Explorer.EXE
PID 2276 wrote to memory of 1176	2276	userinit.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1176	2464	csrss.exe	Explorer.EXE
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 1176 wrote to memory of 1680	1176	Explorer.EXE	regsvr32.exe
PID 1176 wrote to memory of 1680	1176	Explorer.EXE	regsvr32.exe
PID 1176 wrote to memory of 1680	1176	Explorer.EXE	regsvr32.exe
PID 1176 wrote to memory of 1680	1176	Explorer.EXE	regsvr32.exe
PID 1176 wrote to memory of 1680	1176	Explorer.EXE	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1248	2464	csrss.exe	rundll32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1680	2464	csrss.exe	regsvr32.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 1176 wrote to memory of 1292	1176	Explorer.EXE	WinMail.exe
PID 1176 wrote to memory of 1292	1176	Explorer.EXE	WinMail.exe
PID 1176 wrote to memory of 1292	1176	Explorer.EXE	WinMail.exe
PID 1176 wrote to memory of 1292	1176	Explorer.EXE	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 1292	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 2112	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 2112	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 2112	2464	csrss.exe	WinMail.exe
PID 2464 wrote to memory of 2112	2464	csrss.exe	WinMail.exe
PID 1292 wrote to memory of 2112	1292	WinMail.exe	WinMail.exe
PID 1292 wrote to memory of 2112	1292	WinMail.exe	WinMail.exe
PID 1292 wrote to memory of 2112	1292	WinMail.exe	WinMail.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\file.ps1
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2520

C:\Windows\system32\mmc.exe
"C:\Windows\system32\mmc.exe" C:\Windows\system32\diskmgmt.msc
1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1644

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1908

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
PID:2028

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1796

C:\Windows\system32\DrvInst.exe
DrvInst.exe "1" "200" "STORAGE\Volume\{18111a60-3d65-11ef-8487-806e6f6e6963}#0000003AFFF00000" "" "" "65d657873" "0000000000000000" "00000000000005D4" "00000000000005D8"
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Program Files\Windows Sidebar\sidebar.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /showGadgets
1⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
PID:636

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x540
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2644

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2880

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2192

C:\Windows\system32\OptionalFeatures.exe
"C:\Windows\system32\OptionalFeatures.exe"
1⤵
PID:2328

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1364

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1924

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:592

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2464

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2980

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1240

C:\Windows\system32\userinit.exe
C:\Windows\system32\userinit.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:2276

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
3⤵
- Modifies visibility of file extensions in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1176

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
4⤵
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:1680

C:\Program Files (x86)\Windows Mail\WinMail.exe
"C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
4⤵
- Drops desktop.ini file(s)
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1292

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
5⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2112

C:\Windows\System32\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
4⤵
- Enumerates connected drives
- Modifies registry class
PID:2284

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2652

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
4⤵
- System Location Discovery: System Language Discovery
PID:2324

C:\Windows\System32\ie4uinit.exe
"C:\Windows\System32\ie4uinit.exe" -UserConfig
4⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious use of AdjustPrivilegeToken
PID:2944

C:\Windows\System32\ie4uinit.exe
C:\Windows\System32\ie4uinit.exe -ClearIconCache
5⤵
PID:2356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
5⤵
- System Binary Proxy Execution: Rundll32
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
PID:2412

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
5⤵
PID:2624

C:\Windows\system32\RunDll32.exe
C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
6⤵
PID:1924

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
4⤵
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
PID:2620

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2364

C:\Windows\System32\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
4⤵
- Enumerates connected drives
- Modifies registry class
PID:1888

C:\Windows\System32\regsvr32.exe
"C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
4⤵
- Drops startup file
- Drops desktop.ini file(s)
PID:2240

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
4⤵
PID:3688

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
4⤵
PID:3696

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fdd7688,0x13fdd7698,0x13fdd76a8
5⤵
PID:3708

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
5⤵
- Drops file in Windows directory
PID:3748

C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13fdd7688,0x13fdd7698,0x13fdd76a8
6⤵
PID:3764

C:\Windows\System32\txpn4-.exe
"C:\Windows\System32\txpn4-.exe"
4⤵
PID:2444

C:\Program Files\Windows Sidebar\sidebar.exe
"C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
4⤵
PID:2572

C:\Windows\SysWOW64\runonce.exe
C:\Windows\SysWOW64\runonce.exe /Run6432
4⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:2496

C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
"C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
5⤵
- System Location Discovery: System Language Discovery
PID:3096

C:\Windows\System32\mctadmin.exe
"C:\Windows\System32\mctadmin.exe"
4⤵
- Drops desktop.ini file(s)
PID:2716

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.DefaultPrograms
4⤵
PID:3600

C:\Windows\System32\control.exe
"C:\Windows\System32\control.exe" /name Microsoft.BackupAndRestore
4⤵
PID:476

C:\Windows\system32\sdclt.exe
"C:\Windows\system32\sdclt.exe" /BLBBACKUPWIZARD
4⤵
PID:3220

C:\Windows\system32\recdisc.exe
"C:\Windows\system32\recdisc.exe"
4⤵
PID:3364

C:\Windows\system32\wermgr.exe
"C:\Windows\system32\wermgr.exe" "-outproc" "1176" "2232"
4⤵
PID:2208

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
PID:2328

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2064

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1248

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:2540

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2528

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2380

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:932

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1896

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{9200689A-F979-4EEA-8830-0E1D6B74821F}
1⤵
PID:3516

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:3836

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
PID:3844

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
2⤵
PID:3728

C:\Windows\system32\utilman.exe
utilman.exe /debug
2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:4000

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
- System Location Discovery: System Language Discovery
PID:1716

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1164

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:3096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Pre-OS Boot

T1542

Bootkit

T1542.003

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Active Setup

T1547.014

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery