Malware Analysis Report

2024-10-19 08:16

Sample ID 240831-gvqlbszanl
Target c8a46327ca3a8a0a5db01c32ba508f20.zip
SHA256 f65a6c0437aec13cc840e6f957cc81bf7fe91c0d2970c6c079ebb9fffec67a13
Tags
expiro backdoor discovery evasion trojan
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f65a6c0437aec13cc840e6f957cc81bf7fe91c0d2970c6c079ebb9fffec67a13

Threat Level: Known bad

The file c8a46327ca3a8a0a5db01c32ba508f20.zip was found to be: Known bad.

Malicious Activity Summary

expiro backdoor discovery evasion trojan

Expiro, m0yv

Expiro payload

Disables taskbar notifications via registry modification

Executes dropped EXE

Windows security modification

Enumerates connected drives

Checks installed software on the system

Drops file in System32 directory

Drops file in Windows directory

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of SetWindowsHookEx

Suspicious use of AdjustPrivilegeToken

Modifies data under HKEY_USERS

Suspicious behavior: LoadsDriver

Suspicious behavior: EnumeratesProcesses

Modifies registry class

Suspicious use of WriteProcessMemory

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-31 06:07

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-31 06:07

Reported

2024-08-31 06:10

Platform

win10v2004-20240802-en

Max time kernel

149s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe"

Signatures

Expiro, m0yv

backdoor expiro

Expiro payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Disables taskbar notifications via registry modification

evasion

Windows security modification

evasion trojan
Description Indicator Process Target
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-656926755-4116854191-210765258-1000\EnableNotifications = "0" C:\Windows\System32\alg.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-656926755-4116854191-210765258-1000 C:\Windows\System32\alg.exe N/A

Checks installed software on the system

discovery

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\U: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\Q: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\V: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\E: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\M: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\N: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\P: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\K: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Y: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\W: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\G: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\J: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\L: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\T: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\H: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\I: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\R: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\X: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\O: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\S: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\Z: C:\Windows\System32\alg.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File opened for modification \??\c:\windows\SysWOW64\sgrmbroker.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\diagsvcs\diagnosticshub.standardcollector.service.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\openssh\bnbjqpie.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\SysWOW64\gebhkiga.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\SysWOW64\msiexec.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\mcaiamen.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\vssvc.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\spectrum.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\wbengine.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\perceptionsimulation\perceptionsimulationservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\openssh\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\svchost.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG C:\Windows\System32\msdtc.exe N/A
File created \??\c:\windows\system32\cokfdogg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\jajflife.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\vssvc.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\wbem\wmiApsrv.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\nlpafafh.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\SysWOW64\omdddaek.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\sensordataservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\Agentservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\bifmbndg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\jcdoacfn.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\SysWOW64\cmpphcho.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\lsass.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\openssh\ssh-agent.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\tieringengineservice.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\SysWOW64\Agentservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\WindowsPowerShell\v1.0\hkmnfjgq.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\lggdanch.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\diagsvcs\pgbcpqnj.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\perceptionsimulation\perceptionsimulationservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\pjhjgiaa.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\snmptrap.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\wbem\wmiApsrv.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\tieringengineservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\sgrmbroker.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\alg.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\cgkldjnn.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\lnpamkpe.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\pafeoiim.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\wbengine.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\svchost.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\windows\system32\cgcgnilg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\msdtc.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\sensordataservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\dllhost.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\diagsvcs\diagnosticshub.standardcollector.service.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\fxssvc.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\dllhost.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\system32\msiexec.exe C:\Windows\System32\alg.exe N/A
File opened for modification \??\c:\windows\SysWOW64\perfhost.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\system32\locator.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\SysWOW64\spectrum.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Common Files\microsoft shared\VSTO\10.0\jkgaipki.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\7-Zip\nccafaqk.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\lhbjhkab.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\cedpmnkl.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mgecidfd.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\olemadei.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\program files\windows media player\wmpnetwk.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\7-Zip\7zFM.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\onbaidqf.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\program files (x86)\microsoft\edge\Application\92.0.902.67\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\program files\common files\microsoft shared\source engine\ose.exe C:\Windows\System32\alg.exe N/A
File created \??\c:\program files\windows media player\aedioipn.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\dotnet\ddnfppgh.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\program files (x86)\mozilla maintenance service\ibpjjjnc.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ekchdkjb.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\dddilmae.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\7-Zip\gkooamha.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Internet Explorer\hfoijjjp.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Program Files\dotnet\dotnet.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\miqfjfol.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\jmofaklb.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ExtExport.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\InputPersonalization.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ShapeCollector.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\kgacdccg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Java\jdk-1.8\bin\ldcnmoao.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\hlepeenn.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Internet Explorer\dendjgfp.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\program files (x86)\mozilla maintenance service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Internet Explorer\kjkookie.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Internet Explorer\iediagcmd.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\OFFICE16\pgildlkb.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\program files (x86)\google\update\googleupdate.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\mnmjadqg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\mip.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Google\Chrome\Application\123.0.6312.123\obkakffi.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files (x86)\Microsoft\Edge\Application\oelcpmfj.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\7-Zip\7z.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\kihlpche.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created \??\c:\program files\google\chrome\Application\123.0.6312.123\gpaekjco.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe C:\Windows\System32\alg.exe N/A
File created C:\Program Files\7-Zip\jgpijieg.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ClickToRun\occlljkq.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\jfjkgccl.tmp C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
File opened for modification \??\c:\windows\microsoft.net\framework64\v3.0\wpf\presentationfontcache.exe C:\Windows\System32\alg.exe N/A
File opened for modification C:\Windows\DtcInstall.log C:\Windows\System32\msdtc.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1134 = "Microsoft Routing Extension" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-8 = "Microsoft Malayalam to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{01BE4CFB-129A-452B-A209-F9D40B3B84A5} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000006583774a6cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\notepad.exe,-469 = "Text Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1131 = "Route through e-mail" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1133 = "Print" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{F81B1B56-7613-4EE4-BC05-1FAB5DE5C07E} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000b0af024a6cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-121 = "Microsoft Word 97 - 2003 Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-194 = "Microsoft Excel Add-In" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1130 = "Microsoft Modem Device Provider" C:\Windows\system32\fxssvc.exe N/A
Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{A38B883C-1682-497E-97B0-0A3A9E801682} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000548774486cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\zipfldr.dll,-10195 = "Compressed (zipped) Folder" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@windows.storage.dll,-21825 = "3D Objects" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\Windows.UI.Immersive.dll,-38304 = "Public Account Pictures" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-174 = "Microsoft PowerPoint Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9909 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-9 = "Microsoft Bengali to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-3 = "Microsoft Traditional Chinese to Simplified Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{3DBEE9A1-C471-4B95-BBCA-F39310064458} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000c64a98486cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-24585 = "Cascading Style Sheet Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@fxsresm.dll,-1132 = "Store in a folder" C:\Windows\system32\fxssvc.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9937 = "3GPP Audio/Video" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mhtml C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-914 = "SVG Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{8082C5E6-4C27-48EC-A809-B8E1122E8F97} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 0100000000000000ed0d084c6cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-184 = "Microsoft PowerPoint Macro-Enabled Design Template" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.svg\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@"C:\Windows\system32\windowspowershell\v1.0\powershell.exe",-105 = "Windows PowerShell XML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-123 = "Microsoft Word Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Multimedia\ActiveMovie C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-6 = "Microsoft Cyrillic to Latin Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.mht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\OpenWithList C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-4 = "Microsoft Simplified Chinese to Traditional Chinese Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\unregmp2.exe,-9914 = "Windows Media Audio/Video file" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32,@elscore.dll,-10 = "Microsoft Hangul Decomposition Transliteration" C:\Windows\system32\SearchIndexer.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.pdf C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MPEG2Demultiplexer C:\Windows\system32\SearchFilterHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\{4EFE2452-168A-11D1-BC76-00C04FB9453B}\Default MidiOut Device C:\Windows\system32\SearchFilterHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-913 = "MHTML Document" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-170 = "Microsoft PowerPoint 97-2003 Presentation" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\System32\ieframe.dll,-10046 = "Internet Shortcut" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Common Files\system\wab32res.dll,-10100 = "Contacts" C:\Windows\system32\SearchProtocolHost.exe N/A
Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Windows\system32\wmphoto.dll,-500 = "Windows Media Photo" C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{E2FB4720-F45F-4A3C-8CB2-2060E12425C3} {886D8EEB-8CF2-4446-8D02-CDBA1DBDCF99} 0xFFFF = 01000000000000004297114c6cfbda01 C:\Windows\system32\SearchProtocolHost.exe N/A
Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX86\Microsoft Shared\Office16\oregres.dll,-140 = "Microsoft OneNote Section" C:\Windows\system32\SearchProtocolHost.exe N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000_Classes\Local Settings C:\Windows\system32\OpenWith.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A
N/A N/A C:\Windows\System32\alg.exe N/A

Suspicious behavior: LoadsDriver

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeTakeOwnershipPrivilege N/A C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe N/A
Token: SeAuditPrivilege N/A C:\Windows\system32\fxssvc.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\alg.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\system32\msiexec.exe N/A
Token: 33 N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\system32\SearchIndexer.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Windows\system32\OpenWith.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer C:\Windows\System32\alg.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" C:\Windows\System32\alg.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe

"C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe"

C:\Windows\system32\OpenWith.exe

C:\Windows\system32\OpenWith.exe -Embedding

C:\Windows\System32\alg.exe

C:\Windows\System32\alg.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv

C:\Windows\system32\fxssvc.exe

C:\Windows\system32\fxssvc.exe

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"

C:\Windows\System32\msdtc.exe

C:\Windows\System32\msdtc.exe

C:\Windows\system32\msiexec.exe

C:\Windows\system32\msiexec.exe /V

C:\Windows\system32\SearchIndexer.exe

C:\Windows\system32\SearchIndexer.exe /Embedding

C:\Windows\system32\SearchProtocolHost.exe

"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"

C:\Windows\system32\SearchFilterHost.exe

"C:\Windows\system32\SearchFilterHost.exe" 0 804 808 816 8192 812 788

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.27.171.150.in-addr.arpa udp

Files

memory/2328-0-0x00000000006DA000-0x000000000076D000-memory.dmp

memory/2328-1-0x0000000000670000-0x000000000076D000-memory.dmp

memory/2328-2-0x00000000006DA000-0x000000000076D000-memory.dmp

memory/2328-4-0x0000000000670000-0x000000000076D000-memory.dmp

memory/2328-5-0x0000000000670000-0x000000000076D000-memory.dmp

C:\Users\Admin\AppData\Local\pdorddlq\mdqainph.tmp

MD5 d67ebcdb6fb579aacb66a3fbcada08e9
SHA1 1b32a0af7c15a9d67cfca081cb217d4faaed85d4
SHA256 704024eaa2ffa8203b9ee83dbaf4a7b158dc1042ef29bb36e4e2afa99372ad41
SHA512 02c1f1c63178700cee27ca0ae4c9deebb90f8d117d7404f945ec1685f6cba76b87be707c692cae949e88cc8fc886169f602644172e4845ef9c52b99dc69b9adf

C:\Windows\System32\alg.exe

MD5 44ea67931589e79c48675cae5b2e409f
SHA1 40fc590cb20999741268d61b5139781cd63b8f68
SHA256 0c572934e7920f617e08fbcf183aad401f46f05686ba53d5f1b191cf1117be0c
SHA512 0e2240c8ab28dcc9d47b204793449bdcde69a7fa381dd02a8e008e06ce1eb66dd26725c01d0ddd4d050dcfd43452fd28f789e8e6f05b2fbe60c5318f0376090e

C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe

MD5 0651010b8e5f5107a30c50f1cf01d862
SHA1 339d62025126670fa7b4116a58a6b7615a6d5651
SHA256 854391a8c791683c5e3266b776a016c3912566114d135792fcc4105384ec6a4c
SHA512 23c7dea457dfca60efb3c60124101abc0a1b5ae95e22db533797972ea27bb68d3f9e260165b39ec6807fd11277f34f8b7bb0f880fb1818b51a4d60132c8456d3

C:\Windows\System32\FXSSVC.exe

MD5 fb5f16b4137ab0a10921ce6a2f057126
SHA1 1d51f6e394c28754909274944dc16eb6a69649c4
SHA256 6e3f6e739cb71d1c306dbb80579e8fe16d56002f53a693dab32214ce8448924f
SHA512 c83357baa3a8583bea742e9bbe40f62eb7e3c746081045c4c528263e9714ea38dfd32483555816a78e0a013aebfb90ef15014966a2604dd2a40aaa705ce0a256

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe

MD5 8ccad9b3a36add26463dbd0933819e3c
SHA1 5b8bf794fd2296a6c417d37de98856e8abd77d64
SHA256 64f2b5e882f783e45dc6a64bf000e98fa08658ee91ac32abf1a8489b4c030aef
SHA512 8456bbeace624145032d3f04840a478b31205b557b6937f0cb4848f04c3b1ef0f8231baf8a27854dae47d405102b03357732da44ed24bec6989a20f528843942

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe

MD5 9b347e6bf8bd3ffa9e390d454aeb3976
SHA1 f0960611fe2aadf21352737ba47fbe2ce61cf009
SHA256 902230bb653ddd40a9d12c4e523de64e1e5ea33f35cf6c503c5115403da908cc
SHA512 d533cd4eabc20fb948ba505f4f7834bf41342d42a38c3446cfd1a077adc8e4c144939d5ebddb3341e0c1bcdec8a9ba0a11a9cbed85f72edfe9267eec3c56050e

memory/4160-59-0x0000000140000000-0x0000000140136000-memory.dmp

\??\c:\windows\system32\Appvclient.exe

MD5 e183dcf6ba80b74235a8bca5ab4a341c
SHA1 68eff27418f38cccd6bd36e489cbff773bc9f91b
SHA256 acecc24bd6e088f6f773fc365651f68854fe1bc638a5428b4636f2da71df8c68
SHA512 3fad7b435ec6600346fa9ad7e5a85f8b8284940d10dabef0eb285b8935099877c91197905174e8efceae1e2acbff04b6e460f0f4a0a15c9cf7519fd2cd89fc85

C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe

MD5 a9547ed4cfc4e0dec2318f585f9c7345
SHA1 2f903679a2faaa16fab41761170ede7dfcf3d77b
SHA256 bf9fc0dab494fe471376df8fde2405e68ff942cb7d0f0f8014887ee2db4ee323
SHA512 20f4baef62212fc7ec07f269f09a7a0dac1dd3d784b46272697cecda012939fff5fae7801b42a07e2f01615b272afd53a27160cbe2523f16f2546d31bdd01c8d

C:\Program Files\Common Files\microsoft shared\Source Engine\cbiocmnd.tmp

MD5 c0a3de0c48ed478ce3f422cdbe4ccbf2
SHA1 30722b85156a3d3533e8b7423adf8b9ea1736708
SHA256 b19478813773d34957a2d547b2f905f9e5a128bc7e2e3ad7049c7713b01cda51
SHA512 cd94ef865dd521076a5332d2abc00f5fa39b9c64decd8e1247ccbe241b245aa867920f15bb8d899d2003ffed0396eae0ed2a8fa3f67e4267a250d6bd91ac1490

C:\Windows\System32\msdtc.exe

MD5 001223cd27156051443ec23e7987bbc1
SHA1 f5a55bbf5fae9edd62abae1e09984a8e15b700cd
SHA256 64dba0ee4dba236aba84380c314a3e086aff38aca232a31c3fb1d5e9c0124243
SHA512 1bca2141bd15a6b7dddef00ee6ec880130dec3788785ef3db2e2f90f61dbfa9d1a8f1346155d22eff0579c04790adc2dfcbfc548b21582d91528bc1a47d7253b

C:\Windows\system32\msiexec.exe

MD5 6027b9c5a43a34e517fe0ad7d720a501
SHA1 29788ea03a6104c734fb85310584c2effdc320c2
SHA256 0c24bc377e8f546bcd5bdc60e9e7f20029d7babbd2ac4a4e6e6c2d7faf500434
SHA512 42f0b9bdadd6d507476a04c608407106abdc785823a31ab50a0ae61d6577f0ff359e46791a68b6cd79ef006a91a399ddc259037a9cef849c31650c05428563d0

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

MD5 ad137324736354f5b893b3560d62e854
SHA1 2b07050514a1f03f16439e49b0bd70d8edbbd9e4
SHA256 482f97620670ce7ee85a3f4e011d7613048a3d138a60d176ac1c0bd1aeec16fa
SHA512 8c36f79c09784a30c55cb11e45b5595fdd756ea0e07dd3d0d33c2ad48cd7cc0038395fb11d6ede425df90fc5f29bbd8bc7af12e2965692dbfd80487cb4ae9f4d

C:\Program Files\7-Zip\7z.exe

MD5 548bcdbf9eab7e825053be851fd0c5fe
SHA1 65d0e164e9477cea7a584031ff004a9cfc5e3022
SHA256 2125b76602dff85f02d2cee68d2e037e748ec5089beba52ffeb86d3b14c9988e
SHA512 f984388067355ca0ced63c955b4b18626253a7de8c41b18e022fefc24e8af88495ca340ee81bd1515ca16de959007fddff23a30329e8ece62e6224c9a9e6a1fc

C:\Program Files\7-Zip\7zFM.exe

MD5 f04b5eace639dcb9c1fecf36b355628f
SHA1 5f83bd6b8bcdb6b0c9a99b2e7a7b42fedfe96909
SHA256 4878274fdc82122e4385a2fa2056029b81c26763c58f9524105b40288254392b
SHA512 4b6add8efa852791066de6e7fad292ab0d68cfb24ab7c645aa9d2e9122c6057ce0d4e578cbaa9256a2e77d9a7ac725eb3b8dfb3fead216446489e48079f655e5

C:\Program Files\7-Zip\7zG.exe

MD5 5f34d5fed5ab57a6f2bb9361b506d7f2
SHA1 fad4b3580438e8f506ec33cb077ba588f164ca64
SHA256 cb177c803f0395de73e3c371f2e41ea746fe20a2c7a13fbede96f4ea76fe78e5
SHA512 c355a14e7d5e1d4e7b832c546248561fa88e03998c6d0adfdadd6c207ffe8fd53f2fdc1e2e036c3cf8c58f47608f234c9e4950481bb2237f893e112a81a71703

C:\Program Files\7-Zip\Uninstall.exe

MD5 1260f6c29c945c6d9706dc2681fb6f60
SHA1 9ce122aa2038cd9eabd9c40d64b9c77713e904c6
SHA256 673975f795a6d16d639f7ac00378d23fcbb86f1874dbaf17b4fd07913552c2b4
SHA512 16ef2bf114f24ba012c5f09ace4ed95eaf04d65b1093bac8ff67b5cfaf1665199b8005bcfc92f6271c51fa01a7b95e5ea9a19c28e1a2e6d9b481fb8546a7d574

C:\Windows\System32\SearchIndexer.exe

MD5 d2efdd47face1a1fe6f978b707088dbb
SHA1 3d8a0f9e7531d35bd5d3f30b6dbb23dd23e86c27
SHA256 e9b757f870bb25f7e21346dde21943dc2a236f83c5f10b3461b4f3d031920556
SHA512 dc6831158765d0662d2291af58e844cc02099ad963bf1425517b107e3262ec8164f514318e831d21fc36ef537730ddede471244f5be929f8965eb80004a371f9

memory/1756-259-0x0000000002500000-0x0000000002510000-memory.dmp

memory/1756-275-0x0000000002780000-0x0000000002790000-memory.dmp

memory/1756-291-0x0000000006DF0000-0x0000000006DF8000-memory.dmp

memory/1756-300-0x0000000008BC0000-0x0000000008BC8000-memory.dmp

memory/2120-302-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-303-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-304-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-305-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-306-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-307-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-308-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-309-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-310-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-311-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-312-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-313-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-314-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-315-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-316-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-317-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-323-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-324-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-325-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-326-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-327-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-328-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-329-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-330-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-331-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-332-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-333-0x000001475B7F0000-0x000001475B800000-memory.dmp

memory/2120-334-0x000001475B7F0000-0x000001475B800000-memory.dmp

C:\Windows\system32\windowspowershell\v1.0\powershell.exe

MD5 4eb54bea93599d4487bc229ebdac1906
SHA1 7ba0fc12859b011cf249ba9e383e261d88f9ff6b
SHA256 0b517de39d28ae419de93357f65e0e22f932755393e27b2961e179a8c5dec6fc
SHA512 aa91071c65e10b8f07d51a3cfaa0f748bb19f07350161addef82610cab191eff6859620bef96eb87dd9de86ed0e20ea5dbd68ab5ead00bc28c32a258b55a716b

C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe

MD5 ecbe3894fab03dd15a94272adb0f864f
SHA1 32833193c1cc59b0b19bb54efc96df75595d3832
SHA256 c5efc1e80b0107fc2a58da465eba7ed1d5d9f2a04d2ae4056f872e719e6d5e1c
SHA512 3f3507cff13bd093cd6cbc21145489f794cafe2a51bf359d0b9f78585d0c1759bac730541fdc21c2ee14259c93ffdd1da9971250001f7c3a7a0286f3954aba4a

C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe

MD5 25e8bbf74891bf48c3573c4913464a13
SHA1 e7b71b6009fd75d2e1b934429a626b36c28ee0e1
SHA256 f396abae1a8c4cfce0a771911cf66f1c7ef3dde673c2435e2b3b49165d8c2175
SHA512 a052bfb0ed205249511a18835561d4f6ec5b6d1e0c87c7e60bae885968b5031f4ea4574764f7a6fc681ca64e1eb0bd4906cd9f606e20679368b2e01f814eebb2

C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe

MD5 4bfb82077f4f2c6da214a5abc7c77d89
SHA1 9e1d4fc4908e28aebb49a7452460a4682fb44b41
SHA256 601c7f285d68562824851b53700582eac8b486bc633a1fe4bc165e5b1e12a726
SHA512 9684069b76574297f26ca04440cb14f7047dee84d220f74c3260d77edafd40f9d7b1c1ff81445d173b3f1bf71a3d8350cd4f04becae409ffe0df5cb8a177698d

C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe

MD5 52e6befc8868b6a7b7c055cbd3a620cb
SHA1 a897d590a8ab42c3a67a6d5b6d6fe59b32d2395c
SHA256 72e9d0ea2008329f3f4b6018d68d875c021b242cd571835e2a983617e809cb2c
SHA512 2e4c9463d3794c80f33f0a566269faa11342abc4cfe60afea520420e9bea109742284bfa271ac50285e0c6f69c8d7adb0c368665bf75e552da332503764d9334

C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe

MD5 2db94bcad48a134d23b0b10e81ae7aa9
SHA1 e48a3715182e412aab1708b088d95566661bde8b
SHA256 f5d751740fca2af8f00eb8ae4a3f6e57fd8f72c4f608455aa146dd15a5713d17
SHA512 5f9597019d25accbd3675e533bb7edaef698ca505f9fb74bcbfe2d1cbf17f84cfd3a399849451bdbf808ffc394b24eaf80c2daa2dbd82f1c510abd9d78c6ceca

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-31 06:07

Reported

2024-08-31 06:10

Platform

win7-20240708-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe"

Signatures

Expiro, m0yv

backdoor expiro

Expiro payload

backdoor
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Processes

C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe

"C:\Users\Admin\AppData\Local\Temp\a993b8b9658d2639469658237a8139d10ac282e8e5776e35d5e6ebc762af9625.exe"

Network

N/A

Files

memory/2172-0-0x000000000041A000-0x00000000004AD000-memory.dmp

memory/2172-1-0x00000000003B0000-0x00000000004AD000-memory.dmp

memory/2172-2-0x000000000041A000-0x00000000004AD000-memory.dmp