hxxp://fgfdgfd

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 21 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "a"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
2844	rundll32.exe

Drops desktop.ini file(s) 52 IoCs

description	ioc	Process
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File created	C:\Users\a\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\a\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Favorites\Links for United States\desktop.ini	mctadmin.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\a\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\a\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Links\desktop.ini	regsvr32.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Users\a\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-312935884-697965778-3955649944-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\a\Downloads\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\3kmwe8.exe	taskmgr.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\a\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Explorer.EXE
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	explorer.exe
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	explorer.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	chrmstp.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Explorer.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE

Enumerates system info in registry 2 TTPs 35 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\5	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\Security	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\Settings	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\Enable Browser Extensions = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\16\IEFixedFontName = "Vani"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\17	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Document Windows\width = 00000080	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Desktop\General	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\IntelliForms	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\13	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\Use_DlgBox_Colors = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\37	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch	mctadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\New Windows	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\37\IEFixedFontName = "Khmer UI"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\24	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\36\IEPropFontName = "Myanmar Text"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Settings\Use Anchor Hover Color = "No"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\BrowserEmulation	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Settings\Text Color = "0,0,0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\IETld\LowMic	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\LowRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\24\IEPropFontName = "MS PGothic"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\12\IEPropFontName = "Raavi"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\14	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\33	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\26\IEFixedFontName = "NSimsun"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\27\IEPropFontName = "Nyala"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\10\IEFixedFontName = "Mangal"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\20	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\15\IEFixedFontName = "Vijaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Khmer UI"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\31	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\SQM\InstallDate = "1726688948"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\GPU	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\16	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\23\IEPropFontName = "Gulim"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\22\IEPropFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\19\IEPropFontName = "Angsana New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\Show_FullURL = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Settings\Background Color = "192,192,192"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\28\IEPropFontName = "Euphemia"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\SQM	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\Disable Script Debugger = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\SOFTWARE\Microsoft\Internet Explorer\Main	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\9	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\International\Scripts\10	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cda	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3g2	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = 00000000ffffffff	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mpegurl	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmd\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.WMS\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/mp4	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/msvideo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aif	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.au	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\9\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wpl\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.midi\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-mpeg2a	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MMS\shell\open	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\11\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Rev = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/3gpp2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-wav	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.AudioCD\shell\Play	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\CurrentVersion\SyncMgr\StartAtLogin = "0"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "6"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\5\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Mode = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\ShellEx\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP.DVD\Shell\Play\Command	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	Explorer.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 19002f433a5c000000000000000000000000000000000000000000	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	Explorer.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-aiff	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.M2T\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mid	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.DVR-MS\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.rmi\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.WMD\OpenWithProgIds	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\6\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "18874369"	Explorer.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1001_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\7\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/x-mplayer2	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds	unregmp2.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
1616	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe
284	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
2496	taskmgr.exe
2752	Explorer.EXE
284	taskmgr.exe
1924	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeShutdownPrivilege	1852	chrome.exe
Token: SeDebugPrivilege	2496	taskmgr.exe
Token: SeShutdownPrivilege	1700	LogonUI.exe
Token: SeSecurityPrivilege	1036	winlogon.exe
Token: SeBackupPrivilege	1036	winlogon.exe
Token: SeSecurityPrivilege	1036	winlogon.exe
Token: SeTcbPrivilege	1036	winlogon.exe
Token: SeManageVolumePrivilege	1668	WinMail.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2324	ie4uinit.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeRestorePrivilege	2844	rundll32.exe
Token: SeManageVolumePrivilege	2716	WinMail.exe
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeDebugPrivilege	1616	taskmgr.exe
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeDebugPrivilege	284	taskmgr.exe
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeSecurityPrivilege	284	taskmgr.exe
Token: SeTakeOwnershipPrivilege	284	taskmgr.exe
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE
Token: SeShutdownPrivilege	2752	Explorer.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
1852	chrome.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe
2496	taskmgr.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1668	WinMail.exe
2716	WinMail.exe
2752	Explorer.EXE
2752	Explorer.EXE
1924	explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2080	1852	chrome.exe	31
PID 1852 wrote to memory of 2080	1852	chrome.exe	31
PID 1852 wrote to memory of 2080	1852	chrome.exe	31
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2852	1852	chrome.exe	33
PID 1852 wrote to memory of 2868	1852	chrome.exe	34
PID 1852 wrote to memory of 2868	1852	chrome.exe	34
PID 1852 wrote to memory of 2868	1852	chrome.exe	34
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35
PID 1852 wrote to memory of 2568	1852	chrome.exe	35

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fgfdgfd
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7069758,0x7fef7069768,0x7fef7069778
  2⤵
  PID:2080
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:2
  2⤵
  PID:2852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2280 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2288 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1532 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:2
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2248 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2416 --field-trial-handle=1284,i,13169729180383721065,9040562782080402905,131072 /prefetch:1
  2⤵
  PID:1460

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1644

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2496

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1556

C:\Windows\system32\sethc.exe
sethc.exe 211
1⤵
PID:1504
- C:\Windows\system32\net.exe
  net user a /add
  2⤵
  PID:1536
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 user a /add
    3⤵
    PID:2776

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:2800

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2696
- C:\Windows\system32\conhost.exe
  \??\C:\Windows\system32\conhost.exe "-385976997545739520-2142275929-280182598-171644224810765424811711611128173173523"
  2⤵
  PID:820

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1036
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  PID:688
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    PID:2752
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:2988
  - - C:\Program Files (x86)\Windows Mail\WinMail.exe
      "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      PID:1256
    - - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
        5⤵
        Drops desktop.ini file(s)
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1668
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Enumerates connected drives
      Modifies registry class
      PID:2880
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:820
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
      4⤵
      System Location Discovery: System Language Discovery
      PID:2772
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -UserConfig
      4⤵
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of AdjustPrivilegeToken
      PID:2324
    - - C:\Windows\System32\ie4uinit.exe
        
        C:\Windows\System32\ie4uinit.exe -ClearIconCache
        5⤵
        
        PID:1116
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
        5⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2844
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
        5⤵
        
        PID:2608
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:1776
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:1452
  - - C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2716
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Enumerates connected drives
      Modifies registry class
      PID:2204
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:2388
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
      4⤵
      PID:2404
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
      4⤵
      PID:1888
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\a\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13f5e7688,0x13f5e7698,0x13f5e76a8
        5⤵
        
        PID:1928
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        Drops file in Windows directory
        
        PID:2792
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\a\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x15c,0x160,0x164,0x130,0x168,0x13f5e7688,0x13f5e7698,0x13f5e76a8
        6⤵
        
        PID:2824
  - - C:\Windows\System32\3kmwe8.exe
      "C:\Windows\System32\3kmwe8.exe"
      4⤵
      PID:1752
  - - C:\Program Files\Windows Sidebar\sidebar.exe
      "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
      4⤵
      PID:2836
  - - C:\Windows\SysWOW64\runonce.exe
      C:\Windows\SysWOW64\runonce.exe /Run6432
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2172
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1580
  - - C:\Windows\System32\mctadmin.exe
      "C:\Windows\System32\mctadmin.exe"
      4⤵
      Drops desktop.ini file(s)
      Modifies Internet Explorer settings
      PID:1428
  - - C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1616
    - - C:\Windows\system32\taskmgr.exe
        
        "C:\Windows\system32\taskmgr.exe" /1
        5⤵
        Drops file in System32 directory
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:284
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Boot or Logon Autostart Execution: Active Setup
        Drops file in Windows directory
        Modifies registry class
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of SetWindowsHookEx
        
        PID:1924
        
        C:\Windows\system32\UserAccountControlSettings.exe
        
        "C:\Windows\system32\UserAccountControlSettings.exe"
        7⤵
        
        PID:2204
        
        C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe"
        7⤵
        
        PID:1108
- C:\Windows\system32\sethc.exe
  sethc.exe 211
  2⤵
  PID:756
- - C:\Windows\system32\net.exe
    net user Guest /add
    3⤵
    PID:448
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Guest /add
      4⤵
      PID:2948
- - C:\Windows\system32\net.exe
    net user Administrator /add
    3⤵
    PID:2144
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user Administrator /add
      4⤵
      PID:1256

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1640

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1568

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1560

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2292

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2928

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}
1⤵
PID:2352

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1568

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}
1⤵
PID:2472

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}
1⤵
PID:2604

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery