Analysis
-
max time kernel
1050s -
max time network
1050s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
18-09-2024 06:56
Static task
static1
Behavioral task
behavioral1
Sample
alterware-launcher.exe
Resource
win10-20240404-en
General
-
Target
alterware-launcher.exe
-
Size
2.7MB
-
MD5
4af0f95919968b3532fd5109f1e6fee6
-
SHA1
bdd35631146d1cc10f43374a14dc3d9c80168d37
-
SHA256
743db4f06c2d37ec3a1a5bc9869266638544b9acf24e1403e7776c1dff357284
-
SHA512
c3292412774dbb72132803786e7f30b6b87f976660b34fe78aca2222080acdefde9d44484914bdc889a79ef0e22582b6752b1f170b9067926c4b562dee1d763a
-
SSDEEP
49152:QTnKYBANPY2maIwCnY73C6YV0EoViMYdxHqPljH2mQtvt1w:Dv9jAtV1
Malware Config
Extracted
crimsonrat
185.136.161.124
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
wannacry
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Signatures
-
CrimsonRAT main payload 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000800000001ad96-6483.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 7 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
setup.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\ = "AVG Secure Browser" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\StubPath = "\"C:\\Program Files\\AVG\\Browser\\Application\\127.0.26097.121\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Localized Name = "AVG Secure Browser" setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\IsInstalled = "1" setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982}\Version = "43,0,0,0" setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components setup.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{48F69C39-1356-4A7B-A899-70E3539D4982} setup.exe -
Downloads MZ/PE file
-
Event Triggered Execution: Image File Execution Options Injection 1 TTPs 2 IoCs
Processes:
AVGBrowserUpdate.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AVGBrowserUpdate.exe\DisableExceptionChainValidation = "0" AVGBrowserUpdate.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
avg_secure_browser_setup.exeaj5A64.exeAVGBrowser.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation avg_secure_browser_setup.exe Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation aj5A64.exe Key value queried \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\International\Geo\Nation AVGBrowser.exe -
Drops startup file 4 IoCs
Processes:
WannaCrypt0r.exeWannaCry.exedescription ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDFE20.tmp WannaCrypt0r.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD1943.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD194A.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDFE19.tmp WannaCrypt0r.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 45 IoCs
Processes:
avg_secure_browser_setup.exeaj5A64.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserInstaller.exesetup.exesetup.exeAVGBrowserCrashHandler.exeAVGBrowserCrashHandler64.exesetup.exesetup.exeAVGBrowser.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserCrashHandler.exeAVGBrowserCrashHandler64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedlrarhsiva.exetaskdl.exe@[email protected]@[email protected]taskhsvc.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exetaskdl.exetaskse.exe@[email protected]taskdl.exetaskse.exe@[email protected]taskse.exe@[email protected]taskdl.exe!WannaDecryptor!.exepid Process 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 2764 AVGBrowserUpdateSetup.exe 6968 AVGBrowserUpdate.exe 7524 AVGBrowserUpdate.exe 7556 AVGBrowserUpdate.exe 7584 AVGBrowserUpdateComRegisterShell64.exe 7612 AVGBrowserUpdateComRegisterShell64.exe 7628 AVGBrowserUpdateComRegisterShell64.exe 7676 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 8124 AVGBrowserInstaller.exe 8052 setup.exe 4856 setup.exe 7172 AVGBrowserCrashHandler.exe 7220 AVGBrowserCrashHandler64.exe 7476 setup.exe 7564 setup.exe 7644 AVGBrowser.exe 4844 AVGBrowserUpdate.exe 2292 AVGBrowserUpdate.exe 3844 AVGBrowserUpdate.exe 7792 AVGBrowserCrashHandler.exe 5768 AVGBrowserCrashHandler64.exe 696 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 204 dlrarhsiva.exe 1500 taskdl.exe 1356 @[email protected] 5456 @[email protected] 2876 taskhsvc.exe 2472 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 7464 taskdl.exe 7672 taskse.exe 5544 @[email protected] 7420 taskdl.exe 6808 taskse.exe 6172 @[email protected] 6840 taskse.exe 5636 @[email protected] 5204 taskdl.exe 7764 !WannaDecryptor!.exe -
Loads dropped DLL 49 IoCs
Processes:
avg_secure_browser_setup.exeaj5A64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowser.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exetaskhsvc.exepid Process 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 6968 AVGBrowserUpdate.exe 7524 AVGBrowserUpdate.exe 7556 AVGBrowserUpdate.exe 7584 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 7612 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 7628 AVGBrowserUpdateComRegisterShell64.exe 7556 AVGBrowserUpdate.exe 6968 AVGBrowserUpdate.exe 6968 AVGBrowserUpdate.exe 7676 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 7696 AVGBrowserUpdate.exe 7756 AVGBrowserUpdate.exe 4996 aj5A64.exe 7644 AVGBrowser.exe 2292 AVGBrowserUpdate.exe 4844 AVGBrowserUpdate.exe 3844 AVGBrowserUpdate.exe 696 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 4844 AVGBrowserUpdate.exe 6964 AVGBrowserUpdate.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe 2876 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
WannaCry.exereg.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\Ransomware\\WannaCry.exe\" /r" WannaCry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\grgzzewzdng210 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_The-MALWARE-Repo-master.zip\\The-MALWARE-Repo-master\\Ransomware\\tasksche.exe\"" reg.exe -
Checks for any installed AV software in registry 1 TTPs 4 IoCs
Processes:
avg_secure_browser_setup.exeaj5A64.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVAST Software\Avast avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast aj5A64.exe Key opened \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\AVAST Software\Avast aj5A64.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
aj5A64.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA aj5A64.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
msiexec.exedescription ioc Process File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe -
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs
Processes:
flow ioc 1525 raw.githubusercontent.com 1567 camo.githubusercontent.com 1568 camo.githubusercontent.com 1569 camo.githubusercontent.com 1589 camo.githubusercontent.com 176 camo.githubusercontent.com 1353 raw.githubusercontent.com 1524 raw.githubusercontent.com 1526 raw.githubusercontent.com 1564 camo.githubusercontent.com 1565 camo.githubusercontent.com 1566 camo.githubusercontent.com -
Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs
Processes:
flow ioc 1142 https://storage.googleapis.com/script.aniview.com/ssync/62f53b2c7850d0786f227f64/ssync.html -
Writes to the Master Boot Record (MBR) 1 TTPs 4 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
aj5A64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedescription ioc Process File opened for modification \??\PhysicalDrive0 aj5A64.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe File opened for modification \??\PhysicalDrive0 AVGBrowserUpdate.exe -
Sets desktop wallpaper using registry 2 TTPs 4 IoCs
Processes:
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCrypt0r.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp" !WannaDecryptor!.exe -
Drops file in Program Files directory 64 IoCs
Processes:
aj5A64.exeAVGBrowserUpdateSetup.exesetup.exeAVGBrowserInstaller.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exesetup.exedescription ioc Process File created C:\Program Files\AVG\Browser\AVGBrowserUninstall.exe aj5A64.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_uk.dll AVGBrowserUpdateSetup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\ffmpeg.dll setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\hr.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\nl.pak setup.exe File opened for modification C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe AVGBrowserInstaller.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Extensions\external_extensions.json setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\pl.pak setup.exe File opened for modification C:\Program Files\Crashpad\settings.dat setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\sk.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\@PaxHeader AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdateCore.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_es.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_id.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateOnDemand.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fr.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\bn.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_fa.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_nl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ru.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_tr.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\gu.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_en.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_no.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdate.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\d3dcompiler_47.dll setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\it.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdateComRegisterShell64.exe AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_nl.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sr.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_lt.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_pl.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\sl.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_el.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\chrome_100_percent.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\psmachine_64.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_ja.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_sw.dll AVGBrowserUpdate.exe File opened for modification C:\Program Files (x86)\GUM6EA5.tmp\@PaxHeader AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_am.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_fi.dll AVGBrowserUpdate.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_kn.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\browser_crash_reporter.exe setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserCrashHandler.exe AVGBrowserUpdateSetup.exe File opened for modification C:\Program Files (x86)\AVG\Browser\Update\Download\{48F69C39-1356-4A7B-A899-70E3539D4982}\127.0.26097.121\AVGBrowserInstaller.exe AVGBrowserUpdate.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_tr.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ar.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_ur.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\ar.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\mojo_core.dll setup.exe File created C:\Program Files\AVG\Browser\Application\SetupMetrics\bdb029ac-edb6-4595-87a4-74834842932c.tmp setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\psmachine.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_lt.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\en-GB.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\hu.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\lv.pak setup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_es-419.dll AVGBrowserUpdate.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\ca.pak setup.exe File created C:\Program Files\AVG\Browser\Temp\source8052_2006164296\Safer-bin\127.0.26097.121\Locales\es-419.pak setup.exe File created C:\Program Files (x86)\GUM6EA5.tmp\goopdateres_pl.dll AVGBrowserUpdateSetup.exe File created C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\goopdateres_gu.dll AVGBrowserUpdate.exe -
Drops file in Windows directory 10 IoCs
Processes:
msiexec.exetaskmgr.exedescription ioc Process File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\Installer\SourceHash{EDB7AEE7-E932-4836-AE50-D3B0B7766CB5} msiexec.exe File created C:\Windows\Installer\e6003d1.msi msiexec.exe File created C:\Windows\rescache\_merged\4183903823\2290032291.pri taskmgr.exe File created C:\Windows\Installer\e6003cd.msi msiexec.exe File opened for modification C:\Windows\Installer\e6003cd.msi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\MSI469.tmp msiexec.exe File created C:\Windows\rescache\_merged\1601268389\715946058.pri taskmgr.exe -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
Processes:
firefox.exedescription ioc Process File created C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier firefox.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 49 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
!WannaDecryptor!.exe@[email protected]avg_secure_browser_setup.execmd.execscript.exe!WannaDecryptor!.execmd.exeAVGBrowserUpdate.execscript.execmd.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exevssadmin.exeAVGBrowserUpdate.exetaskkill.execmd.exe!WannaDecryptor!.exeAVGBrowserUpdateSetup.exeAVGBrowserUpdate.exe@[email protected]WMIC.exeAVGBrowserUpdate.exetaskdl.exeattrib.exe!WannaDecryptor!.exeAVGBrowserUpdate.exeWannaCrypt0r.exe@[email protected]@[email protected]cmd.exereg.execmd.exetaskkill.exetaskkill.exeAVGBrowserUpdate.exevssadmin.exe@[email protected]AVGBrowserUpdate.exetaskse.exeaj5A64.execmd.exetaskhsvc.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeattrib.exeicacls.exetaskkill.exeWMIC.exeWannaCry.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language avg_secure_browser_setup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cscript.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdateSetup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskdl.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language !WannaDecryptor!.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCrypt0r.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vssadmin.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @[email protected] Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskse.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aj5A64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskhsvc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AVGBrowserUpdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WannaCry.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
AVGBrowserUpdate.exepid Process 7676 AVGBrowserUpdate.exe -
Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exeaj5A64.exedescription ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj5A64.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI aj5A64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Checks processor information in registry 2 TTPs 16 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exefirefox.exefirefox.exefirefox.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid Process 6900 vssadmin.exe 5324 vssadmin.exe -
Kills process with taskkill 4 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exepid Process 2188 taskkill.exe 876 taskkill.exe 6296 taskkill.exe 6740 taskkill.exe -
Processes:
AVGBrowserUpdate.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppName = "AVGBrowserUpdateBroker.exe" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\AppPath = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6" AVGBrowserUpdate.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{28E08968-59C8-4A77-BEBA-12C9394AE077}\Policy = "3" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{513C6D01-E4A3-4F34-9BD9-3D83C35A3498}\AppName = "AVGBrowserUpdateWebPlugin.exe" AVGBrowserUpdate.exe -
Modifies data under HKEY_USERS 34 IoCs
Processes:
AVGBrowserUpdate.exemsiexec.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedescription ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\ AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Owner = 04130000e030a63b9909db01 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineIdDate = "20240918" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\dnsapi.dll,-103 = "Domain Name System (DNS) Server Trust" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\AVG\Browser AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager msiexec.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\SessionHash = 1b605a6f2fd94a6da6ee3ea9a0547eaa7d44b13dcd2929cb0f5be6dd4fb24645 msiexec.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000\Sequence = "1" msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\@%SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe,-124 = "Document Encryption" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\endpoint = "update.avgbrowser.com" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\MachineId = "000058d4b27a012b9e3e4541471e6c69" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" AVGBrowserUpdate.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\devmode = "0" AVGBrowserUpdate.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\AVG\Browser\Update\hostprefix AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\RestartManager\Session0000 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft msiexec.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 AVGBrowserUpdate.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache AVGBrowserUpdate.exe -
Modifies registry class 64 IoCs
Processes:
AVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exeAVGBrowserUpdateComRegisterShell64.exeAVGBrowserUpdate.exesetup.exemsiexec.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ = "IRegistrationUpdateHook" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods\ = "10" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdateComRegisterShell64.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D}\InprocServer32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVG.Update3WebControl.3 AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3WebSvc\CurVer AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A012A499-D8A6-4F6C-9E05-B02D58E3781A}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32\ = "C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\psmachine.dll" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\CLSID setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0929891C-854C-4BFF-AE54-7EE10636719D} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0BE1521-7935-42E6-B606-058A559910BA}\NumMethods\ = "11" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\LocalizedString = "@C:\\Program Files (x86)\\AVG\\Browser\\Update\\1.8.1693.6\\goopdate.dll,-3000" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.OnDemandCOMClassSvc.1.0\CLSID\ = "{30612A81-C10F-498E-9163-C2B2A3F81A14}" AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ = "IRegistrationUpdateHook" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3A708F91-06A3-409E-83BC-4A5CF10C8025}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6DD8E03F-6BE1-41E2-B931-A37C7D1C0317} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\Software\Classes\TypeLib\{358EC846-617A-4763-8656-50BF6E0E8AA2}\1.0\0\win64 setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CredentialDialogMachine.1.0\ = "goopdate CredentialDialog" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE} AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\ = "IGoogleUpdate3" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{45F7CBA5-258D-4852-AD0A-B18F3FB214F4}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2}\InprocHandler32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B02B2F29-8637-4B78-892A-CFD7CCE793EC}\ = "IGoogleUpdate3WebSecurity" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\NumMethods\ = "24" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe\AppID = "{82C85EAA-7C94-4702-AA75-DF39403AE358}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C0BAA6C-52FD-4A3F-8731-F588C5E8F191}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\7EEA7BDE239E6384EA053D0B7B67C65B\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.CoCreateAsync\CLSID\ = "{B80EC6B9-55FF-4E4F-B4E8-9BD098DBBAA5}" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7B73E65-20BA-407F-8A89-DF649EF82559}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AB785069-B832-4423-B813-47F7422BA6E5}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AVGUpdate.Update3COMClassService AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{30612A81-C10F-498E-9163-C2B2A3F81A14}\ProgID AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{67F69D86-C3AA-4CBF-A536-C73B5D785FFC}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6CEBE594-0680-4815-86E1-615A6BE65E0E}\NumMethods\ = "4" AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{41A025DF-6171-460F-B9A1-29ECE33E754E}\NumMethods AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9E6B2FC-34C6-435F-BC66-1EA330DB1270} AVGBrowserUpdate.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A27F7BCA-118B-4330-9B07-9092E8F047E2} AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A42B2494-93AE-44E1-B76D-BA8509A5167D}\ = "GoogleUpdate Update3Web" AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\.xhtml\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C7E81D6-0463-485E-8DF5-2ADAD81FAF40} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C32E10AE-6600-4A1E-8BEA-EF89A3072F93}\ProxyStubClsid32 AVGBrowserUpdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59577BB5-F97B-4880-B785-510238C5C5CE}\ProxyStubClsid32\ = "{2E7A212B-A33C-45D6-9EFD-2AB58EFAACF0}" AVGBrowserUpdateComRegisterShell64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A725D612-7D72-48B8-857A-4777781F415C}\LocalServer32\ = "\"C:\\Program Files\\AVG\\Browser\\Application\\127.0.26097.121\\notification_helper.exe\"" setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.webp setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3E21E991-301D-47FD-AB7A-99FBE864EF65}\ProxyStubClsid32 AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{925547A3-663F-4673-A7B7-3FCACCDC4879} AVGBrowserUpdateComRegisterShell64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E37D9308-A3C0-4EC3-87C5-222235C974E3} AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\Software\Classes\AppID setup.exe Key created \REGISTRY\MACHINE\Software\Classes\.xht\OpenWithProgids setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\AVGBrowserUpdate.exe AVGBrowserUpdate.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CCD3788-C8CC-4EE9-8DF7-944B7D9674F2}\NumMethods AVGBrowserUpdateComRegisterShell64.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Processes:
aj5A64.exedescription ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0400000001000000100000001bfe69d191b71933a372a80fe155e5b52000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 5c000000010000000400000000100000190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e199604000000010000001000000078f2fcaa601f2fb4ebc937ba532e75492000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 190000000100000010000000ea6089055218053dd01e37e1d806eedf0f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4 aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 0400000001000000100000001bfe69d191b71933a372a80fe155e5b50300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd aj5A64.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 04000000010000001000000078f2fcaa601f2fb4ebc937ba532e75490f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e4190000000100000010000000ffac207997bb2cfe865570179ee037b92000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e aj5A64.exe -
NTFS ADS 3 IoCs
Processes:
firefox.exefirefox.exedescription ioc Process File created C:\Users\Admin\Downloads\avg_secure_browser_setup.exe:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\Ransomware-Samples-main.zip:Zone.Identifier firefox.exe File created C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier firefox.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid Process 8056 vlc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
avg_secure_browser_setup.exeaj5A64.exepid Process 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 4996 aj5A64.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe 1868 avg_secure_browser_setup.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
vlc.exetaskmgr.exepid Process 8056 vlc.exe 7884 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
firefox.exeaj5A64.exeAVGBrowserUpdate.exeAVGBrowserInstaller.exesetup.exesetup.exefirefox.exeAVGBrowserUpdate.exeAVGBrowserUpdate.exedescription pid Process Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4724 firefox.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: 33 8124 AVGBrowserInstaller.exe Token: SeIncBasePriorityPrivilege 8124 AVGBrowserInstaller.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 8052 setup.exe Token: SeDebugPrivilege 6968 AVGBrowserUpdate.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 4996 aj5A64.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeDebugPrivilege 7476 setup.exe Token: SeIncreaseQuotaPrivilege 4996 aj5A64.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: SeDebugPrivilege 3636 firefox.exe Token: 33 2292 AVGBrowserUpdate.exe Token: SeIncBasePriorityPrivilege 2292 AVGBrowserUpdate.exe Token: SeDebugPrivilege 3844 AVGBrowserUpdate.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
pid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 5544 @[email protected] 6064 !WannaDecryptor!.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
firefox.exefirefox.exevlc.exetaskmgr.exepid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe 7884 taskmgr.exe -
Suspicious use of SetWindowsHookEx 63 IoCs
Processes:
firefox.exeavg_secure_browser_setup.exeaj5A64.exefirefox.exevlc.exe@[email protected]@[email protected]!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe@[email protected]@[email protected]@[email protected]!WannaDecryptor!.exepid Process 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 1868 avg_secure_browser_setup.exe 4996 aj5A64.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 4724 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 8056 vlc.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 3636 firefox.exe 1356 @[email protected] 1356 @[email protected] 5456 @[email protected] 5456 @[email protected] 2472 !WannaDecryptor!.exe 2472 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 4824 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 6064 !WannaDecryptor!.exe 5544 @[email protected] 5544 @[email protected] 6172 @[email protected] 5636 @[email protected] 7764 !WannaDecryptor!.exe 7764 !WannaDecryptor!.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
firefox.exefirefox.exedescription pid Process procid_target PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 3084 wrote to memory of 4724 3084 firefox.exe 77 PID 4724 wrote to memory of 2156 4724 firefox.exe 78 PID 4724 wrote to memory of 2156 4724 firefox.exe 78 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 3092 4724 firefox.exe 79 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 PID 4724 wrote to memory of 2792 4724 firefox.exe 80 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid Process 2388 attrib.exe 3348 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"C:\Users\Admin\AppData\Local\Temp\alterware-launcher.exe"1⤵PID:2820
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3084 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4724 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.0.1267671284\1823111117" -parentBuildID 20221007134813 -prefsHandle 1696 -prefMapHandle 1672 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd99c2aa-7161-4d54-9ef5-0203802ce741} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1776 2a6587d8458 gpu3⤵PID:2156
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.1.1169787363\1860050673" -parentBuildID 20221007134813 -prefsHandle 2120 -prefMapHandle 2116 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {620f07d9-0148-45d2-b2d6-2b51db82db6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 2132 2a658331a58 socket3⤵
- Checks processor information in registry
PID:3092
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.2.3801453\1719471495" -childID 1 -isForBrowser -prefsHandle 2944 -prefMapHandle 2936 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {716fcde3-81c9-4fa7-90e5-ea8f53b321fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3040 2a658759158 tab3⤵PID:2792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.3.1775251606\1732174024" -childID 2 -isForBrowser -prefsHandle 3456 -prefMapHandle 3512 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f4c05aa-8edb-4842-bc3f-926b970cffdc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3516 2a64d762558 tab3⤵PID:3180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.4.1734189433\144661467" -childID 3 -isForBrowser -prefsHandle 3944 -prefMapHandle 3940 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4655f14e-1dee-41ae-b006-e6925bd928f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 3840 2a65dfe4358 tab3⤵PID:3440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.5.772655261\1069716895" -childID 4 -isForBrowser -prefsHandle 4920 -prefMapHandle 4916 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c066793-02a2-4b87-a90b-5aa0059fd45a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4932 2a65efbc858 tab3⤵PID:1596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.6.557133865\1176470708" -childID 5 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f9efff52-f0e8-4ed9-949d-5c37175da84c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5064 2a65f3ed258 tab3⤵PID:3348
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.7.920169307\2112874374" -childID 6 -isForBrowser -prefsHandle 5284 -prefMapHandle 5288 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {99c4915a-364d-47a8-9088-1c685ce2a49a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5276 2a65f3ede58 tab3⤵PID:4256
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.8.1358294070\1157579184" -childID 7 -isForBrowser -prefsHandle 2272 -prefMapHandle 2660 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b182b49-3b8a-4ad8-9918-1c6a4da67e99} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5456 2a658a55b58 tab3⤵PID:4284
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.9.1346521284\1461543781" -childID 8 -isForBrowser -prefsHandle 5016 -prefMapHandle 5004 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c72758a5-6a73-439c-b53a-7b17af7e22a9} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5028 2a661c51958 tab3⤵PID:2428
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.10.1725905689\1780544138" -childID 9 -isForBrowser -prefsHandle 5904 -prefMapHandle 6072 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b74bfa10-7319-4eaa-8dad-95517d2cc15b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5864 2a660b82858 tab3⤵PID:3212
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.11.1743739469\1698006757" -childID 10 -isForBrowser -prefsHandle 5816 -prefMapHandle 5808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d15bfbf-088b-4e80-a2b5-03783afce109} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5416 2a65dfe4658 tab3⤵PID:1224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.12.1207111419\814360943" -childID 11 -isForBrowser -prefsHandle 5352 -prefMapHandle 5480 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5bbfef58-ae2f-49df-9940-2e3875526844} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5528 2a662c4ce58 tab3⤵PID:4076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.13.1895520298\881121082" -childID 12 -isForBrowser -prefsHandle 9904 -prefMapHandle 4460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {24355836-0f5b-4630-af81-da455ba6049a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4576 2a65ef1b158 tab3⤵PID:4388
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.14.1661194221\1637747925" -childID 13 -isForBrowser -prefsHandle 5704 -prefMapHandle 5460 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1fcaa253-53c5-402d-badc-3dcf5bcfe55a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5688 2a658a55e58 tab3⤵PID:1104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.15.1840769970\1736322571" -parentBuildID 20221007134813 -prefsHandle 1448 -prefMapHandle 5432 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2912c9a-4eaa-4b8d-b7c1-3598df6d6aff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4692 2a66376cb58 rdd3⤵PID:4016
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.16.589615036\2106031476" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5384 -prefMapHandle 5372 -prefsLen 26777 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6fde613-d4db-429f-803e-c574eb2d65a5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5396 2a663d98358 utility3⤵PID:3028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.17.1809026445\74364837" -childID 14 -isForBrowser -prefsHandle 5244 -prefMapHandle 4688 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2176320-25d0-4169-a0d3-04dec022470a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 1448 2a65b166058 tab3⤵PID:2088
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.18.1389921718\290118821" -childID 15 -isForBrowser -prefsHandle 9240 -prefMapHandle 9244 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf0efc3-2a34-48d2-b7a8-819cffaa4e93} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661255158 tab3⤵PID:5072
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.19.1069021686\274808377" -childID 16 -isForBrowser -prefsHandle 6356 -prefMapHandle 10116 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {70439923-e539-4a7d-aa93-fb793e6565a4} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4460 2a6645e7358 tab3⤵PID:2076
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.20.1403906855\2093882964" -childID 17 -isForBrowser -prefsHandle 9824 -prefMapHandle 9916 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a5b5297-fc1a-47bb-9e47-cc69b83b2397} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9632 2a6612b7158 tab3⤵PID:2188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.21.1480060550\1005371452" -childID 18 -isForBrowser -prefsHandle 9428 -prefMapHandle 5652 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4d459706-81b8-4f29-8f8f-f0eb8fd7cd0b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9468 2a665066558 tab3⤵PID:808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.22.1877237901\1174862409" -childID 19 -isForBrowser -prefsHandle 5532 -prefMapHandle 4960 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a3eef98-5c1d-4aa3-8826-c24763c8f107} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10012 2a665066b58 tab3⤵PID:4752
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.23.116437921\225715968" -childID 20 -isForBrowser -prefsHandle 8828 -prefMapHandle 8824 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecf8f576-7953-42aa-9ed1-ead3e80e1ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8740 2a665067d58 tab3⤵PID:1404
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.24.1512054813\1847828640" -childID 21 -isForBrowser -prefsHandle 10084 -prefMapHandle 10156 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d81b3ae-3407-4539-941f-074237fc8dcf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10108 2a6641a5558 tab3⤵PID:2796
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.25.596096088\211042372" -childID 22 -isForBrowser -prefsHandle 5032 -prefMapHandle 9088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {823afe6c-9e16-4b71-b080-8967552aa4f2} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9244 2a665b82558 tab3⤵PID:6028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.26.1837840257\726243811" -childID 23 -isForBrowser -prefsHandle 8408 -prefMapHandle 8404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ab028043-c380-438f-937b-8efc015563f1} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8416 2a665b84058 tab3⤵PID:6036
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.27.592645779\835789488" -childID 24 -isForBrowser -prefsHandle 8212 -prefMapHandle 8208 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2c000810-f8a8-4e04-9bca-eea710ff0ce5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8224 2a665b82b58 tab3⤵PID:6044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.28.829295389\1198901972" -childID 25 -isForBrowser -prefsHandle 8492 -prefMapHandle 8848 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c14278fc-867d-465d-b168-862baac50e6f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8508 2a666288558 tab3⤵PID:5924
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.29.1487319126\1800581706" -childID 26 -isForBrowser -prefsHandle 9380 -prefMapHandle 9588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9283e92d-a98a-4662-bde1-4216be5f329b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4300 2a6650bbb58 tab3⤵PID:4376
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.30.921745295\946609326" -childID 27 -isForBrowser -prefsHandle 8588 -prefMapHandle 8528 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4cfac111-78a1-4757-938a-ef158b98d43f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8796 2a662b87858 tab3⤵PID:1868
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.31.180833687\253147647" -childID 28 -isForBrowser -prefsHandle 8052 -prefMapHandle 9808 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e5b46ad-30a1-457a-9c3c-1c7abb977f55} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7900 2a662b8a558 tab3⤵PID:2936
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.32.1009495250\438964623" -childID 29 -isForBrowser -prefsHandle 7984 -prefMapHandle 7988 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f822bdf0-0909-4863-b2af-3fee4271ab73} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8584 2a662dd4258 tab3⤵PID:1224
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.33.2036490974\1695826256" -childID 30 -isForBrowser -prefsHandle 9124 -prefMapHandle 7968 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {972f8608-5bdf-4dd7-88ae-f6b9791520ff} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8972 2a65f3ef658 tab3⤵PID:5380
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.34.337926043\225051119" -childID 31 -isForBrowser -prefsHandle 6152 -prefMapHandle 9064 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0223dea4-d2ed-43cd-b060-67162cf1dbc6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9212 2a661137558 tab3⤵PID:5944
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.35.1212494327\1254117856" -childID 32 -isForBrowser -prefsHandle 8448 -prefMapHandle 7880 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8a67f39-5993-4310-92fc-721123665bfc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7712 2a658a55b58 tab3⤵PID:5488
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.36.340915966\1705405833" -childID 33 -isForBrowser -prefsHandle 7596 -prefMapHandle 7600 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec79109b-4d33-453d-bef0-387790377f6c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4928 2a658a5fd58 tab3⤵PID:4828
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.37.1845489907\2010022783" -childID 34 -isForBrowser -prefsHandle 7424 -prefMapHandle 7428 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e7754ee-9f77-43ab-8b30-d54aae941cc3} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7372 2a661135a58 tab3⤵PID:804
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.38.1183218298\1872634629" -childID 35 -isForBrowser -prefsHandle 7428 -prefMapHandle 7228 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {26a346b5-90ac-4b8b-a85d-6bdf83e619aa} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7212 2a661ea1b58 tab3⤵PID:6180
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.39.1966258158\1483032214" -childID 36 -isForBrowser -prefsHandle 7456 -prefMapHandle 7484 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fde591f9-9e3e-4efb-8075-631de6b84748} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7148 2a661ea3f58 tab3⤵PID:6188
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.40.887713148\14076364" -childID 37 -isForBrowser -prefsHandle 7036 -prefMapHandle 7280 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {082ba880-20e5-4e2a-b62e-b789c1857e44} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6300 2a661ea3658 tab3⤵PID:6196
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.41.1418488241\356406825" -childID 38 -isForBrowser -prefsHandle 7132 -prefMapHandle 7148 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9062af4d-7022-4180-af11-1b5d441ce650} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7016 2a661ea4e58 tab3⤵PID:6204
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.42.1010518286\2046648963" -childID 39 -isForBrowser -prefsHandle 9016 -prefMapHandle 9036 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {90c17369-60ea-4ed8-874d-d4bee027305c} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10044 2a661134258 tab3⤵PID:3400
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.43.1718932381\1659397115" -childID 40 -isForBrowser -prefsHandle 7024 -prefMapHandle 9632 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4005dec-98d6-4c01-ac2f-c167badb1f2a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4336 2a661fe3758 tab3⤵PID:4848
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.44.700547237\1811610808" -childID 41 -isForBrowser -prefsHandle 9464 -prefMapHandle 9168 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89b93205-86ec-4ba6-a5d9-c0ac14f7312f} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 4464 2a66210be58 tab3⤵PID:3636
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.45.119935072\1923932786" -childID 42 -isForBrowser -prefsHandle 5776 -prefMapHandle 5780 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37e63ede-853a-4271-9152-083c883cadcc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6924 2a66210ee58 tab3⤵PID:7012
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.46.63832016\1521595712" -childID 43 -isForBrowser -prefsHandle 8112 -prefMapHandle 8088 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0cdf1b6f-a952-4330-9793-ee805419800e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7028 2a66210c458 tab3⤵PID:4344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.47.1578425455\1523440712" -childID 44 -isForBrowser -prefsHandle 7952 -prefMapHandle 5896 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e312838-ff69-4bce-8a60-676cde5add9b} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8100 2a65c979658 tab3⤵PID:5312
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.48.322449415\10664982" -childID 45 -isForBrowser -prefsHandle 5468 -prefMapHandle 9128 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f77b188-6287-49f6-9673-769742f4685e} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7768 2a65c979c58 tab3⤵PID:6884
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.49.415443667\1105092303" -childID 46 -isForBrowser -prefsHandle 8112 -prefMapHandle 7748 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {da864b61-3c94-498d-ac4e-0430673f31a7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6880 2a65d71eb58 tab3⤵PID:5140
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.50.1145720364\1350694353" -childID 47 -isForBrowser -prefsHandle 8032 -prefMapHandle 8580 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7b2f00b-2f72-497b-b7d4-982ce1e83d96} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8188 2a663a4ba58 tab3⤵PID:5440
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.51.1210471403\1390582392" -childID 48 -isForBrowser -prefsHandle 5896 -prefMapHandle 7952 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e274d02f-f4a0-42eb-9dff-3468c95ba265} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 7804 2a663a4d858 tab3⤵PID:5456
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.52.657155230\1917237364" -childID 49 -isForBrowser -prefsHandle 8432 -prefMapHandle 5864 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d7b75018-d76c-4abd-a2b0-7960066e51fc} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5644 2a663e94e58 tab3⤵PID:3124
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.53.852274923\930609621" -childID 50 -isForBrowser -prefsHandle 8528 -prefMapHandle 5644 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc583d62-cd1e-4bfe-89c5-eb846751d90a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8424 2a66403b158 tab3⤵PID:5596
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.54.1106453375\1209406326" -childID 51 -isForBrowser -prefsHandle 5532 -prefMapHandle 7264 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1beea77-c2ac-4c4b-9b5c-50b9f68e64fe} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5436 2a6640bde58 tab3⤵PID:5480
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.55.1206639682\1690563381" -childID 52 -isForBrowser -prefsHandle 9916 -prefMapHandle 9536 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9aa5514-6a9d-4ec5-ad15-bdc7176547b5} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8404 2a65b178a58 tab3⤵PID:5144
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.56.291904047\748555281" -childID 53 -isForBrowser -prefsHandle 6408 -prefMapHandle 6404 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {66d9236c-ff04-4e9c-8a84-6b0eb25b3f40} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6420 2a663ca0758 tab3⤵PID:5276
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.57.771296403\100132169" -childID 54 -isForBrowser -prefsHandle 6600 -prefMapHandle 6592 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {04385b65-bd9b-476d-9569-29c31dbd2acf} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a66491b858 tab3⤵PID:5956
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.58.251256087\338412576" -childID 55 -isForBrowser -prefsHandle 8412 -prefMapHandle 6588 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb17006b-7c7e-494e-991a-325e038859d7} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 6608 2a664a50e58 tab3⤵PID:5792
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.59.367453286\1350232082" -childID 56 -isForBrowser -prefsHandle 9228 -prefMapHandle 5364 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2af56a99-2242-4a30-957c-f7ca4012ed9a} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 8196 2a664a50558 tab3⤵PID:5340
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.60.1628073918\186263094" -childID 57 -isForBrowser -prefsHandle 10372 -prefMapHandle 10368 -prefsLen 26777 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08c1867a-3107-4904-b2d7-7d740c80e602} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 10332 2a658a33558 tab3⤵PID:6952
-
-
C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"C:\Users\Admin\Downloads\avg_secure_browser_setup.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1868 -
C:\Users\Admin\AppData\Local\Temp\aj5A64.exe"C:\Users\Admin\AppData\Local\Temp\aj5A64.exe" /relaunch=8 /was_elevated=1 /tagdata4⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4996 -
C:\Users\Admin\AppData\Local\Temp\nsl5B4D.tmp\AVGBrowserUpdateSetup.exeAVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:2764 -
C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe"C:\Program Files (x86)\GUM6EA5.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome"6⤵
- Event Triggered Execution: Image File Execution Options Injection
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:6968 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7524
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:7556 -
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7584
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7612
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:7628
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0ie0ZBQkE2QkRGLTUzNUEtNEI4OS1BQjkzLTY1NDQwNEQ0OThEM30iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9Ins1MUVBOEQwMC0wNDY3LTRGQjItQjFCQi0zRkRFQzI0NkRCMTd9IiB1c2VyaWRfZGF0ZT0iMjAyNDA5MTgiIG1hY2hpbmVpZD0iezAwMDA1OEQ0LUIyN0EtMDEyQi05RTNFLTQ1NDE0NzFFNkM2OX0iIG1hY2hpbmVpZF9kYXRlPSIyMDI0MDkxOCIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9IntENjlGQzQwRC1BREUyLTQ3OUUtQTRBMy02Qzg4Q0U4MURBQTR9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTUwNjMuMCIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuLVVTIiBicmFuZD0iOTIyOCIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNDIxIi8-PC9hcHA-PC9yZXF1ZXN0Pg7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:7676
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en-US&brand=9228&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome" /installsource otherinstallcmd /sessionid "{FABA6BDF-535A-4B89-AB93-654404D498D3}" /silent7⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:7696
-
-
-
-
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exesetup.exe /silent --create-shortcuts=0 --install-level=1 --system-level5⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:7476 -
C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe"C:\Program Files\AVG\Browser\Application\127.0.26097.121\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x228,0x22c,0x230,0x204,0x234,0x7ff69aaebfc0,0x7ff69aaebfcc,0x7ff69aaebfd86⤵
- Executes dropped EXE
PID:7564
-
-
C:\Program Files\AVG\Browser\Application\AVGBrowser.exe"C:\Program Files\AVG\Browser\Application\AVGBrowser.exe" --type=shortcut-pin-helper /prefetch:8 startpin "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AVG Secure Browser.lnk"6⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:7644
-
-
-
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.61.1940652448\166545101" -childID 58 -isForBrowser -prefsHandle 6384 -prefMapHandle 10948 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9c1d135-798e-4aad-8279-c21dba086edb} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 9040 2a661fe4c58 tab3⤵PID:8000
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.62.2083818536\981442065" -childID 59 -isForBrowser -prefsHandle 5300 -prefMapHandle 5156 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ce130893-17b0-46ad-8783-1304545a96f6} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5116 2a660b82e58 tab3⤵PID:7664
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4724.63.809849872\775777518" -childID 60 -isForBrowser -prefsHandle 5204 -prefMapHandle 11204 -prefsLen 26826 -prefMapSize 233444 -jsInitHandle 1096 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b035273e-f89e-46f9-bda7-611199a73008} 4724 "\\.\pipe\gecko-crash-server-pipe.4724" 5228 2a662264858 tab3⤵PID:5808
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"3⤵PID:2832
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"4⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3636 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.0.925240826\1867829622" -parentBuildID 20221007134813 -prefsHandle 1644 -prefMapHandle 1620 -prefsLen 17556 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {828be36c-a1f4-4a49-973e-4dbb9e4cfd0f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1724 24ef30f6b58 gpu5⤵PID:4344
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.1.1835994436\830726714" -parentBuildID 20221007134813 -prefsHandle 1892 -prefMapHandle 1888 -prefsLen 17601 -prefMapSize 230321 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e047e6a-b74c-49e7-b6dc-a6ad5177589b} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 1916 24ef2f3a058 socket5⤵
- Checks processor information in registry
PID:1932
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.2.405471480\1993952449" -childID 1 -isForBrowser -prefsHandle 3120 -prefMapHandle 3116 -prefsLen 23698 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ff7fc401-c249-4628-b493-63f370b4c57d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3168 24ef8029358 tab5⤵PID:6032
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.3.1677851904\1540161136" -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3852 -prefsLen 23805 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edc2f267-e2f1-40df-80ad-71f81ccca9b1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3916 24ef87a8558 tab5⤵PID:6028
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.4.1206410041\1263801892" -childID 3 -isForBrowser -prefsHandle 3696 -prefMapHandle 3768 -prefsLen 24887 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8bad0c58-224e-4880-a2b5-a646145f3778} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3712 24ef8eb0858 tab5⤵PID:7916
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.5.786578772\2107368128" -parentBuildID 20221007134813 -prefsHandle 4224 -prefMapHandle 4240 -prefsLen 30501 -prefMapSize 230321 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10e5634a-779d-4447-80ce-4b01cf33bbdd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4304 24efa978258 rdd5⤵PID:5580
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.6.682251912\1532786877" -childID 4 -isForBrowser -prefsHandle 4300 -prefMapHandle 4436 -prefsLen 31920 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0973f103-ce6b-41b8-94a4-9d1647758bcd} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 3904 24efb721e58 tab5⤵PID:7260
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.7.1593891756\1460833457" -childID 5 -isForBrowser -prefsHandle 4860 -prefMapHandle 2888 -prefsLen 32092 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e5f367-8fc9-4f89-ae0a-fc7ec8db136f} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4840 24ef48cdd58 tab5⤵PID:1044
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.8.465074148\197669459" -childID 6 -isForBrowser -prefsHandle 5048 -prefMapHandle 5052 -prefsLen 32016 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cf98c1e-4758-492d-926a-6fac9e26bb9d} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 4892 24ef4a0c758 tab5⤵PID:7160
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.9.988668513\404865402" -childID 7 -isForBrowser -prefsHandle 5636 -prefMapHandle 5712 -prefsLen 32442 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5ae27b6f-2220-4865-af05-4d05477cb071} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 5072 24ef4603558 tab5⤵PID:7104
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.10.16605903\1580975062" -childID 8 -isForBrowser -prefsHandle 6096 -prefMapHandle 6076 -prefsLen 32755 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2a892447-96bf-4f5a-a1cd-750942a58be2} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6032 24efb0da658 tab5⤵PID:5272
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3636.11.150578193\578154528" -childID 9 -isForBrowser -prefsHandle 6600 -prefMapHandle 6580 -prefsLen 32804 -prefMapSize 230321 -jsInitHandle 1216 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c51c0be-ca42-4078-b827-842e2a5d5bb1} 3636 "\\.\pipe\gecko-crash-server-pipe.3636" 6604 24efb0da058 tab5⤵PID:6256
-
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:7756 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\AVGBrowserInstaller.exe" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
PID:8124 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --install-archive="C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\SECURE.PACKED.7Z" --chrome --do-not-launch-chrome --hide-browser-override --show-developer-mode --suppress-first-run-bubbles --default-search-id=3 --default-search=bing.com --adblock-mode-default=0 --no-create-user-shortcuts --make-chrome-default --force-default-win10 --import-cookies --auto-launch-chrome --system-level3⤵
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:8052 -
C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe"C:\Program Files (x86)\AVG\Browser\Update\Install\{96EFEA13-362C-4843-98C4-54E87BC35090}\CR_1EDFD.tmp\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=fake_url --annotation=plat=Win64 --annotation=prod=AVG --annotation=ver=127.0.26097.121 --initial-client-data=0x230,0x234,0x238,0x20c,0x23c,0x7ff62318bfc0,0x7ff62318bfcc,0x7ff62318bfd84⤵
- Executes dropped EXE
PID:4856
-
-
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:7172
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:7220
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2184
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\PushFind.mp3"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:8056
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ua /installsource scheduler1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:4844 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /registermsihelper2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:696
-
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /c1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2292 -
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /cr2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3844
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler.exe"2⤵
- Executes dropped EXE
PID:7792
-
-
C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserCrashHandler64.exe"2⤵
- Executes dropped EXE
PID:5768
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4868
-
C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc1⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:6964
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\RAT\CrimsonRAT.exe"1⤵PID:6184
-
C:\ProgramData\Hdlharas\dlrarhsiva.exe"C:\ProgramData\Hdlharas\dlrarhsiva.exe"2⤵
- Executes dropped EXE
PID:204
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:5548 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2388
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:216
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1500
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 146581726643294.bat2⤵
- System Location Discovery: System Language Discovery
PID:7460 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- System Location Discovery: System Language Discovery
PID:3080
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3348
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1356 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2876
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @[email protected] vs2⤵
- System Location Discovery: System Language Discovery
PID:3044 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5456 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
PID:7512 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:6900
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
PID:7320
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:7464
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:7672
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5544
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f2⤵
- System Location Discovery: System Language Discovery
PID:1976 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "grgzzewzdng210" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies registry key
PID:2908
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:7420
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
PID:6808
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6172
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
PID:6840
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5636
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:5204
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2116 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 13301726643300.bat2⤵
- System Location Discovery: System Language Discovery
PID:6712 -
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
- System Location Discovery: System Language Discovery
PID:6900
-
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6296
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:876
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:2188
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:6740
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2472
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
- System Location Discovery: System Language Discovery
PID:7200 -
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4824 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
PID:6320 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- System Location Discovery: System Language Discovery
- Interacts with shadow copies
PID:5324
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- System Location Discovery: System Language Discovery
PID:4288
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:6064
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_The-MALWARE-Repo-master.zip\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:7764
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:4356
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:7884