Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1158s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
05/09/2024, 19:16
Static task
static1
Behavioral task
behavioral1
Sample
Injector.bat
Resource
win11-20240802-en
General
-
Target
Injector.bat
-
Size
28KB
-
MD5
c2823e12663465c3d4ed6cb56afbeb7a
-
SHA1
8cfa9eb3687179824a8db420cf64992510cf0863
-
SHA256
01324cfb5ade947fcadeaa75ecc4b2d602c46ca3153f7c4fbd00fd1e0c5db3d6
-
SHA512
2d40b80e64a57929d6e9fc0552041029ac15376471fc513cc2a8a6892f938e0de66e85f97bef5489ea27558cc0387b2cb4741c44c252342c2afe1f2b785e64a1
-
SSDEEP
48:SMDRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRRR3:zMU
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe File opened (read-only) \??\F: explorer.exe -
Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchHost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchHost.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Internet Explorer\GPU SearchHost.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\www.bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "14844" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "13248" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1022" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1055" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "13248" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "14844" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 140000000700000001000100050000001400000050003a005c00480066007200650066005c004e0071007a00760061005c004e006300630051006e0067006e005c005900620070006e0079005c005a00760070006500620066006200730067005c00420061007200510065007600690072005c00420061007200510065007600690072002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50100000000000000000000e8070800420061007200510065007600690072000a00410062006700200066007600740061007200710020007600610000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000047b5c086efe4da0100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff82ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e8070800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff83ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1055" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "1055" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "1022" SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "1022" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\MuiCache StartMenuExperienceHost.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{5B434986-19AD-4C58-A57D-13231E77B0A1} explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\bing.com SearchHost.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\bing.com\Total = "8230" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\www.bing.com\ = "13248" SearchHost.exe Key created \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2180 explorer.exe 2180 explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2180 explorer.exe -
Suspicious use of AdjustPrivilegeToken 52 IoCs
description pid Process Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe Token: SeShutdownPrivilege 2180 explorer.exe Token: SeCreatePagefilePrivilege 2180 explorer.exe -
Suspicious use of FindShellTrayWindow 37 IoCs
pid Process 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2180 explorer.exe 4264 SearchHost.exe 3184 StartMenuExperienceHost.exe 2180 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 892 wrote to memory of 2208 892 cmd.exe 82 PID 892 wrote to memory of 2208 892 cmd.exe 82 PID 892 wrote to memory of 1508 892 cmd.exe 84 PID 892 wrote to memory of 1508 892 cmd.exe 84 PID 892 wrote to memory of 2008 892 cmd.exe 86 PID 892 wrote to memory of 2008 892 cmd.exe 86 PID 892 wrote to memory of 2408 892 cmd.exe 87 PID 892 wrote to memory of 2408 892 cmd.exe 87 PID 892 wrote to memory of 2876 892 cmd.exe 88 PID 892 wrote to memory of 2876 892 cmd.exe 88 PID 892 wrote to memory of 1572 892 cmd.exe 89 PID 892 wrote to memory of 1572 892 cmd.exe 89 PID 892 wrote to memory of 2708 892 cmd.exe 90 PID 892 wrote to memory of 2708 892 cmd.exe 90 PID 892 wrote to memory of 1680 892 cmd.exe 91 PID 892 wrote to memory of 1680 892 cmd.exe 91 PID 892 wrote to memory of 3068 892 cmd.exe 92 PID 892 wrote to memory of 3068 892 cmd.exe 92 PID 892 wrote to memory of 4596 892 cmd.exe 93 PID 892 wrote to memory of 4596 892 cmd.exe 93 PID 892 wrote to memory of 3936 892 cmd.exe 95 PID 892 wrote to memory of 3936 892 cmd.exe 95 PID 892 wrote to memory of 1172 892 cmd.exe 96 PID 892 wrote to memory of 1172 892 cmd.exe 96 PID 892 wrote to memory of 2268 892 cmd.exe 97 PID 892 wrote to memory of 2268 892 cmd.exe 97 PID 892 wrote to memory of 1364 892 cmd.exe 98 PID 892 wrote to memory of 1364 892 cmd.exe 98 PID 892 wrote to memory of 5064 892 cmd.exe 99 PID 892 wrote to memory of 5064 892 cmd.exe 99 PID 892 wrote to memory of 4576 892 cmd.exe 101 PID 892 wrote to memory of 4576 892 cmd.exe 101 PID 892 wrote to memory of 5072 892 cmd.exe 102 PID 892 wrote to memory of 5072 892 cmd.exe 102 PID 892 wrote to memory of 4344 892 cmd.exe 103 PID 892 wrote to memory of 4344 892 cmd.exe 103 PID 892 wrote to memory of 1184 892 cmd.exe 104 PID 892 wrote to memory of 1184 892 cmd.exe 104 PID 892 wrote to memory of 856 892 cmd.exe 105 PID 892 wrote to memory of 856 892 cmd.exe 105 PID 892 wrote to memory of 2112 892 cmd.exe 106 PID 892 wrote to memory of 2112 892 cmd.exe 106 PID 892 wrote to memory of 4332 892 cmd.exe 107 PID 892 wrote to memory of 4332 892 cmd.exe 107 PID 892 wrote to memory of 3852 892 cmd.exe 109 PID 892 wrote to memory of 3852 892 cmd.exe 109 PID 892 wrote to memory of 792 892 cmd.exe 110 PID 892 wrote to memory of 792 892 cmd.exe 110 PID 892 wrote to memory of 236 892 cmd.exe 111 PID 892 wrote to memory of 236 892 cmd.exe 111 PID 892 wrote to memory of 5104 892 cmd.exe 112 PID 892 wrote to memory of 5104 892 cmd.exe 112 PID 892 wrote to memory of 804 892 cmd.exe 134 PID 892 wrote to memory of 804 892 cmd.exe 134 PID 892 wrote to memory of 1060 892 cmd.exe 136 PID 892 wrote to memory of 1060 892 cmd.exe 136 PID 892 wrote to memory of 3380 892 cmd.exe 137 PID 892 wrote to memory of 3380 892 cmd.exe 137 PID 892 wrote to memory of 468 892 cmd.exe 138 PID 892 wrote to memory of 468 892 cmd.exe 138 PID 892 wrote to memory of 2304 892 cmd.exe 139 PID 892 wrote to memory of 2304 892 cmd.exe 139 PID 892 wrote to memory of 1460 892 cmd.exe 140 PID 892 wrote to memory of 1460 892 cmd.exe 140 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Injector.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\system32\cmd.execmd2⤵PID:2208
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1508
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2008
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2408
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2876
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1572
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2708
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1680
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3068
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4596
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3936
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1172
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2268
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1364
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5064
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4576
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5072
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4344
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1184
-
-
C:\Windows\system32\cmd.execmd2⤵PID:856
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2112
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4332
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3852
-
-
C:\Windows\system32\cmd.execmd2⤵PID:792
-
-
C:\Windows\system32\cmd.execmd2⤵PID:236
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5104
-
-
C:\Windows\system32\cmd.execmd2⤵PID:804
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1060
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3380
-
-
C:\Windows\system32\cmd.execmd2⤵PID:468
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2304
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1460
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1500
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2492
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5000
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2332
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3128
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4560
-
-
C:\Windows\system32\cmd.execmd2⤵PID:864
-
-
C:\Windows\system32\cmd.execmd2⤵PID:656
-
-
C:\Windows\system32\cmd.execmd2⤵PID:652
-
-
C:\Windows\system32\cmd.execmd2⤵PID:576
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5076
-
-
C:\Windows\system32\cmd.execmd2⤵PID:3192
-
-
C:\Windows\system32\cmd.execmd2⤵PID:4200
-
-
C:\Windows\system32\cmd.execmd2⤵PID:1728
-
-
C:\Windows\system32\cmd.execmd2⤵PID:2736
-
-
C:\Windows\system32\cmd.execmd2⤵PID:952
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5124
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5168
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5248
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5272
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5400
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5408
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5424
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5432
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5456
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5484
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5524
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5532
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5552
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5796
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5812
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5828
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5848
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5856
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5864
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5892
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5900
-
-
C:\Windows\system32\cmd.execmd2⤵PID:5916
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6052
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6096
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6152
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6196
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6204
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6220
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6244
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6264
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6284
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6292
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6300
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6312
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6324
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6408
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6416
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6424
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6432
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6440
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6448
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6456
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6468
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6484
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6496
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6508
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6520
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6536
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6544
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6552
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6560
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6568
-
-
C:\Windows\system32\cmd.execmd2⤵PID:6736
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7308
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7324
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7332
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7340
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7384
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7436
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7576
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7592
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7608
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7616
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7624
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7632
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7640
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7648
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7656
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7664
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7672
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7680
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7688
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7696
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7704
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7712
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7720
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7728
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7736
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7744
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7752
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7760
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7768
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7776
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7836
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7852
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7860
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7868
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7876
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7884
-
-
C:\Windows\system32\cmd.execmd2⤵PID:7892
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7900
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7908
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7916
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7924
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7932
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7940
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7948
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7956
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7964
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7972
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7980
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:7988
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7996
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:8012
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:8020
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:8032
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:8460
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9280
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9288
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9296
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9304
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9312
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9320
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9328
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9336
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9344
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9352
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9360
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9368
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10136
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10148
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10160
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10184
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:8660
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:8184
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9108
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9048
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:7948
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9308
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9952
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:2932
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9536
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9812
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9872
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:9928
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:9292
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:8564
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10004
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:8092
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10472
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10664
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10712
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10724
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10732
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10740
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10880
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10916
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10928
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10956
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10964
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10972
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10980
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:10988
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:10996
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11004
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11012
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11020
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11028
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11036
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11044
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11052
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11060
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11068
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11076
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11084
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11092
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11100
-
-
C:\Windows\explorer.exeexplorer.exe2⤵PID:11108
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11400
-
-
C:\Windows\explorer.exeexplorer.exe2⤵
- Modifies registry class
PID:11548
-
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:9308
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 436 -p 3212 -ip 32121⤵PID:10972
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2180
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4264
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VDS50TL2\www.bing[1].xml
Filesize2KB
MD5c317b689c4211cc89f6a7624360f3783
SHA12c260078eddf3736f054b231bb56934662da3e66
SHA25653bb4211f7dbab4bc246dbf18bc3d4e4269a3dd2debbc71054a33cd32e769042
SHA512f98cd0d193d4adcc773e53d61f75120658667ca9c4b3f6c666008d6563458495beeca98cd890f5361d65aa070b0f34d2bc82f20441187d3ebac6a3521407f02e
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\VDS50TL2\www.bing[1].xml
Filesize17KB
MD5202f06e187e3731eb0a92b677b313b73
SHA177eee468e28284b7353214a7b59c5833d4172f22
SHA256a40a8ff25b6a8eb95d123e3fcbfc51d84fefb4d30aa9da711a11ea4678b17e0a
SHA5121f63b50e51b4f268a15a3d9d7340696c10b49e15b460e50bbc5d913783248469bf2a22eded7f2afd13b9aa538054be92510729a609ddf6fb04d3308f8e2092b1