hxxps://piratebay[.]party

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\IsInstalled = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\StubPath	msiexec.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	spchapi.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	spchcpl.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\ = "Web Folders"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	msttsa22L.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\Version = "10,0,0,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE
Key created	\REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components	MSagent.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\ComponentID = "WebFolders"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{73FA19D0-2D75-11D2-995D-00C04F98BBC9}\Locale = "*"	msiexec.exe

Contacts a large (780) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Downloads MZ/PE file

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigGetSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{B742E236-05EC-4C2D-A049-69ADD8F0025B}\FuncName = "IsFileSupportedName"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCheckCert"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigCreateIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{B742E236-05EC-4C2D-A049-69ADD8F0025B}\Dll = "C:\\PROGRA~2\\MICROS~1\\Office10\\MCPS.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{B742E236-05EC-4C2D-A049-69ADD8F0025B}\FuncName = "PutSignedDataMsg"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubInitialize"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadMessage"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{B742E236-05EC-4C2D-A049-69ADD8F0025B}\Dll = "C:\\PROGRA~2\\MICROS~1\\Office10\\MCPS.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigRemoveSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigCreateIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigCreateIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustFinalPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigRemoveSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigVerifyIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubInitialize"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCheckCert"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadMessage"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadMessage"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadSignature"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "WintrustCertificateTrust"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubInitialize"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCleanup"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustFinalPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.dll"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCheckCert"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigVerifyIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{B742E236-05EC-4C2D-A049-69ADD8F0025B}\Dll = "C:\\PROGRA~2\\MICROS~1\\Office10\\MCPS.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigRemoveSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "SOFTPUB.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCleanup"	MsiExec.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\International\Geo\Nation	utweb.exe

Executes dropped EXE 44 IoCs

pid	Process
4940	utweb_installer.exe
5304	utweb_installer.tmp
3512	utweb_installer.exe
5656	utweb_installer.exe
5684	utweb_installer.tmp
6004	utweb_installer.exe
6036	utweb_installer.tmp
4720	utweb_installer.exe
5528	utweb.exe
3580	msohtmed.exe
6100	SETLANG.EXE
6232	WINWORD.EXE
3620	MSagent.exe
6244	MSagent.exe
5496	MSagent.exe
4720	MSagent.exe
6820	MSagent.exe
6072	MSagent.exe
6368	MSagent.exe
5628	MSagent.exe
3488	MSAGENT.EXE
1892	tv_enua.exe
6660	AgentSvr.exe
7012	WINWORD.EXE
5152	AgentSvr.exe
6660	DaServer.exe
4388	DaServer.exe
3012	WINWORD.EXE
5068	DaServer.exe
6444	MUSH.exe
5696	CyberBuddyFREESetup.exe
5168	CBsetup.exe
5104	MSagent.exe
6116	AgentSvr.exe
4464	tv_enua.exe
5412	spchcpl.exe
2104	spchapi.exe
1936	msttsa22L.exe
2276	merlin.exe
6268	genie.exe
7048	peedy.exe
5068	robby.exe
6324	CyberBud.exe
64	CyberBud.exe

Loads dropped DLL 64 IoCs

pid	Process
3512	utweb_installer.exe
3512	utweb_installer.exe
3512	utweb_installer.exe
3512	utweb_installer.exe
3512	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
4720	utweb_installer.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
6320	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe
2136	MsiExec.exe

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
4444	rundll32.exe

Adds Run key to start application 2 TTPs 11 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Windows\CurrentVersion\Run\utweb = "\"C:\\Users\\Admin\\AppData\\Roaming\\uTorrent Web\\utweb.exe\" /MINIMIZED"	utweb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\Installed = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\GrpConv = "grpconv -o"	rundll32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\Installed = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\NoChange = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\Installed = "1"	msiexec.exe

Blocklisted process makes network request 5 IoCs

flow	pid	Process
6144	1008	msiexec.exe
6146	1008	msiexec.exe
6148	1008	msiexec.exe
6180	6796	msiexec.exe
6181	6796	msiexec.exe

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Avira\Browser\Installed	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	utweb_installer.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\SOFTWARE\Avira\Browser\Installed	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Browser\Installed	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\Avira\Browser\Installed	utweb_installer.tmp

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\DataServices\DESKTOP.INI	msiexec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	MsiExec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	WINWORD.EXE
File opened (read-only)	\??\Y:	WINWORD.EXE
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	MsiExec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	WINWORD.EXE
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Q:	MsiExec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\N:	WINWORD.EXE
File opened (read-only)	\??\I:	MsiExec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	WINWORD.EXE
File opened (read-only)	\??\T:	WINWORD.EXE
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\N:	MsiExec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	WINWORD.EXE
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\U:	MsiExec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	MsiExec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\O:	WINWORD.EXE
File opened (read-only)	\??\W:	WINWORD.EXE
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	MsiExec.exe
File opened (read-only)	\??\B:	WINWORD.EXE
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\E:	MsiExec.exe
File opened (read-only)	\??\L:	MsiExec.exe
File opened (read-only)	\??\X:	MsiExec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\I:	WINWORD.EXE

Detected potential entity reuse from brand MICROSOFT.
phishing microsoft

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\AUTORUN.inf	CyberBuddyFREESetup.exe
File opened for modification	C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\AUTORUN.inf	CyberBuddyFREESetup.exe

Drops file in System32 directory 25 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\RDOCURS.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\FM20ENU.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\VBAEND32.OLB	msiexec.exe
File created	C:\Windows\SysWOW64\VBAEN32.OLB	msiexec.exe
File created	C:\Windows\SysWOW64\SCP32.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\MSSTDFMT.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\MSSTKPRP.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\VSFLEX3.OCX	msiexec.exe
File created	C:\Windows\SysWOW64\w95inf32.dll	MSagent.exe
File opened for modification	C:\Windows\SysWOW64\SET2ECD.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\speech.cpl	spchcpl.exe
File created	C:\Windows\SysWOW64\ATHPRXY.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\MSRDO20.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\FM20.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\MFC42ENU.DLL	msiexec.exe
File opened for modification	C:\Windows\SysWOW64\w95inf16.dll	MSagent.exe
File created	C:\Windows\SysWOW64\SET2ECD.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\SETA034.tmp	spchcpl.exe
File created	C:\Windows\SysWOW64\MSCOMCTL.OCX	msiexec.exe
File created	C:\Windows\SysWOW64\w95inf16.dll	MSagent.exe
File created	C:\windows\SysWOW64\~msexist.tmp	MsiExec.exe
File created	C:\Windows\SysWOW64\VBAME.DLL	msiexec.exe
File created	C:\Windows\SysWOW64\SETA034.tmp	spchcpl.exe
File created	C:\Windows\SysWOW64\VEN2232.OLB	msiexec.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Office\media\cagcat10\J0187423.WMF	msiexec.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\SpeechEngines\TTS\~TMP4352~.TMP	msttsa22L.exe
File created	C:\Program Files (x86)\Microsoft Office\media\cagcat10\J0183290.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\lines\BD21322_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\lines\BD21336_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\left-aligned column_image001.jpg	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\PKMCDO.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Grphflt\MS.BMP	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\autoshap\BD18254_.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD21296_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Selling Your Ideas.pot	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\XLREAD10.HTM	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\1033\WebView\Images\PEND.GIF	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page10.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb011.gif	BonziBuddy432.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\F1.ACG	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Grphflt\WMFIMP32.FLT	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\autoshap\BD18222_.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\autoshap\BD18223_.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD15277_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\MSOSTYLE.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Stream.pot	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\WWPAB.CNV	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb010.gif	BonziBuddy432.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA6\VBACV20.DLL	msiexec.exe
File created	C:\Program Files (x86)\Double Agent\License.htm	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\ManualDirPatcher.bat	BonziBuddy432.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\expenses.mdz	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\FEEDBACK.HTM	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\FPCUTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Themes\Pixel\PREVIEW.GIF	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\t2.nbd	BonziBuddy432.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\PSS10O.CHM	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\VBA\VBA6\1033\FM20.CHM	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\cagcat10\J0234657.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD14985_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\Migration\MIGRATE.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\1033\MSOSVINT.DLL	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page16.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\Common Files\System\OLE DB\MSDMINE.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD15022_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Themes\expeditn\EXPEDITN.INF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\XLTIP10.HLP	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Folders\VAIMEM.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Marketing Plan.pot	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\Presentation Designs\Glass Layers.pot	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Themes\Refined\REFINED.ELM	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Euro\MSOEURO.DLL	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Web Server Extensions\50\bin\FP5AUTL.DLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD15272_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD21314_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD21331_.GIF	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page20.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page10.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\Common Files\System\OLE DB\resources\1033\OLAPUIR.RLL	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD14530_.GIF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\QUIKANIM.PPT	msiexec.exe
File created	C:\Program Files (x86)\Common Files\Microsoft Shared\Themes\sumipntg\SUMIPNTG.INF	msiexec.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb002.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page15.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\Microsoft Office\Office10\1033\WDOW10.AW	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\cagcat10\J0157763.WMF	msiexec.exe
File created	C:\Program Files (x86)\Microsoft Office\media\office10\bullets\BD15275_.GIF	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\MSVCP60.DLL	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB135.tmp	msiexec.exe
File created	C:\Windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53A5.tmp	msiexec.exe
File opened for modification	C:\Windows\msagent\intl\SET96A9.tmp	MSagent.exe
File created	C:\Windows\speech\SETA09A.tmp	spchapi.exe
File created	C:\Windows\msagent\SET3883.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET3885.tmp	MSAGENT.EXE
File created	C:\Windows\help\SET3896.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET9681.tmp	MSagent.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\msxml3r.dll.35210702_493B_42CA_BA13_865C5A8BDAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9551.tmp	msiexec.exe
File created	C:\Windows\SETA573.tmp	msttsa22L.exe
File opened for modification	C:\Windows\Installer\MSI599B.tmp	msiexec.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\ARIALNI.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4545.tmp	msiexec.exe
File opened for modification	C:\Windows\lhsp\tv\SET2EBA.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSagent.exe
File opened for modification	C:\Windows\speech\SETA087.tmp	spchapi.exe
File opened for modification	C:\Windows\Fonts\ANTQUAB.TTF	msiexec.exe
File created	C:\Windows\msagent\SET3884.tmp	MSAGENT.EXE
File created	C:\Windows\speech\SETA088.tmp	spchapi.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\msxml3a.dll.35210702_493B_42CA_BA13_865C5A8BDAC1	msiexec.exe
File opened for modification	C:\Windows\msagent\SET386D.tmp	MSAGENT.EXE
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\GARABD.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI426B.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\lhsp\help\SET9BB1.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File created	C:\Windows\speech\SETA073.tmp	spchapi.exe
File opened for modification	C:\Windows\Installer\MSI9787.tmp	msiexec.exe
File created	C:\Windows\Installer\e68b071.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBDAB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5581.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Fonts\BOOKOSBI.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB8AE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI599D.tmp	msiexec.exe
File opened for modification	C:\Windows\INF\SETA0A0.tmp	spchapi.exe
File opened for modification	C:\Windows\Fonts\BOOKOSB.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB99F.tmp	msiexec.exe
File created	C:\Windows\ShellNew\WINWORD8.DOC	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI950D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI950E.tmp	msiexec.exe
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSagent.exe
File opened for modification	C:\Windows\speech\SETA09C.tmp	spchapi.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File opened for modification	C:\Windows\delttsul.exe	msttsa22L.exe
File opened for modification	C:\Windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\pptico.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI499C.tmp	msiexec.exe
File opened for modification	C:\Windows\fonts\SET9BB2.tmp	tv_enua.exe
File opened for modification	C:\Windows\occache\tv_enua.exe	rundll32.exe
File created	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\GOTHICBI.TTF	msiexec.exe
File opened for modification	C:\Windows\Installer\$PatchCache$\Managed\9040820900063D11C8EF00054038389C\10.0.2627\msxml3r.dll.35210702_493B_42CA_BA13_865C5A8BDAC1	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5417.tmp	msiexec.exe
File created	C:\Windows\msagent\SET3870.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\outicon.exe	msiexec.exe
File opened for modification	C:\Windows\INF\msTTSa22.inf	msttsa22L.exe
File opened for modification	C:\Windows\Installer\MSIB111.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4257.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{90280409-6000-11D3-8CFE-0050048383C9}\xlicons.exe	msiexec.exe
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSagent.exe
File opened for modification	C:\Windows\msagent\SET386F.tmp	MSAGENT.EXE

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 5 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\utweb_installer.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MSagent.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MUSH.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MASS_Setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CyberBuddyFREESetup.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msohtmed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CyberBud.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DaServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SETLANG.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DaServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_enua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	genie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_enua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	robby.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CBsetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	utweb_installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MUSH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	spchcpl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DaServer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSagent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks SCSI registry key(s) 3 TTPs 64 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Mfg	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004C	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0003	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0054	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0058	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\2002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004D	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A\	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0005	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0034	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0038	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0065	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0051	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0016	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Mfg	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\004E	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{88ad39db-0d0c-4a38-8435-4043826b5c91}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0008	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\0006	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0018	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{80d81ea6-7473-4b0c-8216-efc11a2c4c8b}\0002	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\0055	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{656a3bb3-ecc0-43fd-8477-4ae0404a96cd}\300A	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{4340a6c5-93fa-4706-972c-7b648008a5a7}\0008	svchost.exe

Checks processor information in registry 2 TTPs 19 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utweb_installer.tmp
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	utweb_installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	utweb_installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	utweb_installer.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Modifies Internet Explorer settings 1 TTPs 44 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec\Topic	msohtmed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1147E530-A208-11DE-ABF2-002421116FB2}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office10\\WINWORD.EXE\" /n /dde"	msohtmed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{1147E530-A208-11DE-ABF2-002421116FB2}\Compatibility Flags = "2228676"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1147E500-A208-11DE-ABF2-002421116FB2}\Policy = "3"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DependentComponents	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor	msohtmed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office10\\EXCEL.EXE/3000"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec\Application	msohtmed.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1147E500-A208-11DE-ABF2-002421116FB2}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec\Application\ = "WinWord"	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec\Application\ = "WinWord"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DependentComponents\Microsoft Excel 2002 = "5.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	msohtmed.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 430038003400440056006e002d007d0066002800590052005d0065004100520036002e006a00690057004f0052004400460069006c00650073003e004c0026007200660055006d0057002e00630047002e006500250066004900340047007d006a00640020002f006e0020002f0064006400650000000000	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec\ = "[REM _DDE_Direct][FileOpen(\"%1\")]"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec\Topic\ = "System"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec\ = "[REM _DDE_Direct][FileOpen(\"%1\")]"	msohtmed.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec\Topic	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office10\\WINWORD.EXE\" /n /dde"	msohtmed.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 430038003400440056006e002d007d0066002800590052005d0065004100520036002e006a00690057004f0052004400460069006c00650073003e004c0026007200660055006d0057002e00630047002e006500250066004900340047007d006a00640020002f006e0020002f0064006400650000000000	msohtmed.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DependentComponents\Microsoft Access 2002 = "5.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DependentComponents\Microsoft PowerPoint 2002 = "5.0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1147E500-A208-11DE-ABF2-002421116FB2}\AppPath = "C:\\Program Files (x86)\\Double Agent\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ddeexec\Topic\ = "System"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{1147E500-A208-11DE-ABF2-002421116FB2}\AppName = "DaServer.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\DependentComponents\Microsoft Word 2002 = "5.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ddeexec\Application	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Default MHTML Editor	msohtmed.exe

Modifies data under HKEY_USERS 27 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\25	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\24	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1B	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1F	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\20	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\22	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\OnDemandInterfaceCache	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\23	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\24	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1c	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1f	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\21	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\21	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1C	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1d	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\20	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\25	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1e	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65813656-4461-11D3-8C7B-00600832DCED}\TypeLib\ = "{C1CD5353-28E5-11D3-8C76-00600832DCED}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{358BEF5D-0465-11D2-9792-0000F875B2D3}\TypeLib\ = "{62B6DCA8-4811-11D2-96F1-0000F875B2D3}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8BD21D53-EC42-11CE-9E0D-00AA006002F3}\TypeLib\ = "{AC2DE821-36A2-11CF-8053-00AA006009FA}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{EA905CA2-B033-4184-9BB6-29CE0D6F3F04}\1.0\FLAGS	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD000120-8B95-11D1-82DB-00C04FB1625D}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C27CCE37-8596-11D1-B16A-00C0F0283628}\InprocServer32\ = "C:\\Windows\\SysWOW64\\MSCOMCTL.OCX"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F08DF954-8592-11D1-B16A-00C0F0283628}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{0002E510-0000-0000-C000-000000000046}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Word.RTF.8\shell\print\ddeexec\Topic	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\CLASSES\WOW6432Node\Interface\{5F847505-3E17-11D3-BABB-00C04F72FB4E}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D3102290-2B25-11D2-A795-E138CAAEC749}	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BDD-7DE6-11D0-91FE-00C04FD701A5}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{2CB6C2C6-DD7C-11D2-AFE4-00105A994724}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PKMSA.CatalogCommands\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{4C85388F-1500-11D1-A0DF-00C04FC9E20F}\Programmable	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000208E1-0000-0000-C000-000000000046}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7310590-AC80-11D1-8DF3-00C04FB6EF4F}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open"	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00020800-0000-0000-C000-000000000046}\LocalServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53230329-172B-11D0-AD40-00A0C90DC8D9}\ = "iJoinLine"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BDEADF04-C265-11D0-BCED-00A0C90AB50F}\InProcServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\KnowledgeForms.MyWebBrowserEvents2	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{000C0331-0000-0000-C000-000000000046}\TypeLib\Version = "2.2"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A99C7A7D-1703-4C19-95E0-CEC9638B5F04}\TypeLib\ = "{C278AFDA-7859-4397-BFA2-66A9A0072483}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.xlv	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{CD00010E-8B95-11D1-82DB-00C04FB1625D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MSDDS.PictureShape.1\ = "Microsoft DDS Picture Shape Control"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5B39B06-1480-11D3-8549-00C04FAC67D7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32A1C62A-D374-11D3-8D21-0050048383FB}\TypeLib\ = "{4AFFC9A0-5F99-101B-AF4E-00AA003F0F07}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CD000125-8B95-11D1-82DB-00C04FB1625D}\ProxyStubClsid32	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{D7053240-CE69-11CD-A777-00DD01143C57}\Implemented Categories\{7DD95801-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{87BB25A1-2194-4E0B-B315-996C376F94CF}\TypeLib\Version = "2.0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0002E550-0000-0000-C000-000000000046}\1.0\FLAGS	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B82F916C-9F4B-11D1-ABE4-00C04FC30999}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C731070C-AC80-11D1-8DF3-00C04FB6EF4F}\TypeLib\ = "{C7310691-AC80-11D1-8DF3-00C04FB6EF4F}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CA478DA0-3920-11D3-9DD0-8067E4A06603}\TypeLib\ = "{972DE6B5-8B09-11D2-B652-A1FD6CC34260}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPoint.Slide.8\shell\Show\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Basic.8\CLSID\ = "{000209FE-0000-0000-C000-000000000046}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5B39B47-1480-11D3-8549-00C04FAC67D7}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5512D11C-5CC6-11CF-8D67-00AA00BDCE1D}\Version	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MsoHelpKeyDlg.2\CLSID\ = "{B58C2440-A1A3-11D2-B024-006097C9A284}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5E71F04B-551F-11CF-8152-00AA00A40C25}\ = "_rdoEngine"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35DBD76F-99D2-4F30-9E43-CBE9E85F4022}\TypeLib	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Components\10BE92CC2CB71D119A12000A9CE1A22A\pcd = 430038003400440056006e002d007d0066002800590052005d0065004100520036002e006a00690047007200610070006800690063007300460069006c007400650072007300500043004400460069006c00650073003e006f00710054005d006a0049007b006a00660028003d00310026004c005b002d00380031002d005d004b006f00640061006b002000500068006f0074006f002000430044005c0031005c0031005c0070006300640000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0B77459F-5CCB-11D1-9966-00C04FB937E1}\TypeLib	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B06E968-E47C-11CD-8701-00AA003F0F07}\TypeLib	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{64818D10-4F9B-11CF-86EA-00AA00B929E8}\DataFormats\GetSet\2\ = "1,1,1,1"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{AC0714F6-3D04-11D1-AE7D-00A0C90F26F4}\Instance CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FPDTC.LISTVIEWCTL.1\CLSID\ = "{4421FEE2-A45D-11D3-9F7C-005004AE6818}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{47A38391-2E1E-11D1-86AE-00C04FB6DE33}\TypeLib\Version = "1.0"	MsiExec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{5DCE7E34-3155-11D1-993A-00C04FB937E1}	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C7310590-AC80-11D1-8DF3-00C04FB6EF4F}\ = "IDssAppList"	MsiExec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F0E42D60-368C-11D0-AD81-00A0C90DC8D9}\InprocServer32\InprocServer32 = 430038003400440056006e002d007d0066002800590052005d0065004100520036002e006a00690041004300430045005300530053006e0061007000730068006f007400460069006c00650073003e007b0033006d002d004900680074006d00660028006700360075002e0051002800330031006100520000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CD00020E-8B95-11D1-82DB-00C04FB1625D}\ = "Microsoft PKM KnowledgeCatalog Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C7310712-AC80-11D1-8DF3-00C04FB6EF4F}\TypeLib\ = "{C7310691-AC80-11D1-8DF3-00C04FB6EF4F}"	MsiExec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Excel.Macrosheet\shell\Print\ddeexec\application	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0002091F-0000-0000-C000-000000000046}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CDA1CA02-8B5D-11D0-9BC0-0000C0F04C96}\ = "ISSReturnShort"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5512D122-5CC6-11CF-8D67-00AA00BDCE1D}\MiscStatus\ = "657809"	MsiExec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Excel.XLL\shell\Open	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\MSOlapAdmin2.MSOLAPLastError\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\PowerPoint.Slide.8\HTML Handler\Icon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{000208AD-0000-0000-C000-000000000046}\TypeLib\Version = "1.4"	MsiExec.exe

Modifies system certificate store 2 TTPs 8 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 040000000100000010000000ee2931bc327e9ae6e8b5f751b4347190030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d34317e000000010000000800000000c001b39667d6011d0000000100000010000000e871723e266f38af5d49cda2a502669c14000000010000001400000055e481d11180bed889b908a331f9a1240916b9700b000000010000001e00000045006e0074007200750073007400200028003200300034003800290000006200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1777f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b06010505070307530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d819000000010000001000000091fad483f14848a8a69b18b805cdbb3a20000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	utweb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 5c00000001000000040000000008000019000000010000001000000091fad483f14848a8a69b18b805cdbb3a0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d3431040000000100000010000000ee2931bc327e9ae6e8b5f751b434719020000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	utweb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431	utweb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	utweb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\503006091D97D4F5AE39F7CBE7927D7D652D3431\Blob = 19000000010000001000000091fad483f14848a8a69b18b805cdbb3a0f0000000100000014000000327fc447408de9bf596f83d4b2fa4b8e3e7097d8090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b06010505070308530000000100000041000000303f3020060a6086480186fa6c0a010230123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c07f000000010000002c000000302a060a2b0601040182370a030406082b0601050507030506082b0601050507030606082b060105050703076200000001000000200000006dc47172e01cbcb0bf62580d895fe2b8ac9ad4f873801e0c10b9c837d21eb1770b000000010000001e00000045006e00740072007500730074002000280032003000340038002900000014000000010000001400000055e481d11180bed889b908a331f9a1240916b9701d0000000100000010000000e871723e266f38af5d49cda2a502669c7e000000010000000800000000c001b39667d601030000000100000014000000503006091d97d4f5ae39f7cbe7927d7d652d343120000000010000002e0400003082042a30820312a00302010202043863def8300d06092a864886f70d01010505003081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f7269747920283230343829301e170d3939313232343137353035315a170d3239303732343134313531325a3081b431143012060355040a130b456e74727573742e6e65743140303e060355040b14377777772e656e74727573742e6e65742f4350535f3230343820696e636f72702e206279207265662e20286c696d697473206c6961622e2931253023060355040b131c286329203139393920456e74727573742e6e6574204c696d69746564313330310603550403132a456e74727573742e6e65742043657274696669636174696f6e20417574686f726974792028323034382930820122300d06092a864886f70d01010105000382010f003082010a0282010100ad4d4ba91286b2eaa320071516642a2b4bd1bf0b4a4d8eed8076a567b77840c07342c868c0db532bdd5eb8769835938b1a9d7c133a0e1f5bb71ecfe524141eb181a98d7db8cc6b4b03f1020cdcaba54024007f7494a19d0829b3880bf587779d55cde4c37ed76a64ab851486955b9732506f3dc8ba660ce3fcbdb849c176894919fdc0a8bd89a3672fc69fbc711960b82de92cc99076667b94e2af78d665535d3cd69cb2cf2903f92fa450b2d448ce0532558afdb2644c0ee4980775db7fdfb9085560853029f97b48a46986e3353f1e865d7a7a15bdef008e1522541700902693bc0e496891bff847d39d9542c10e4ddf6f26cfc3182162664370d6d5c007e10203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041455e481d11180bed889b908a331f9a1240916b970300d06092a864886f70d010105050003820101003b9b8f569b30e753997c7a79a74d97d7199590fb061fca337c46638f966624fa401b2127cae67273f24ffe3199fdc80c4c6853c680821398fab6adda5d3df1ce6ef6151194820cee3f95af11ab0fd72fde1f038f572c1ec9bb9a1a4495eb184fa61fcd7d57102f9b04095a84b56ed81d3ae1d69ed16c795e791c14c5e3d04c933b653ceddf3dbea6e5951ac3b519c3bd5e5bbbff23ef6819cb1293275c032d6f30d01eb61aacde5af7d1aaa827a6fe7981c479993357ba12b0a9e0426c93ca56defe6d840b088b7e8dead79821c6f3e73c792f5e9cd14c158de1ec2237cc9a430b97dc80908db3679b6f48081556cfbff12b7c5e9a76e95990c57c8335116551	utweb.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	utweb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 0f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e1996530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703080b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac89988140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f1d0000000100000010000000a86dc6a233eb339610f3ed414927c559030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	utweb.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 190000000100000010000000ffac207997bb2cfe865570179ee037b9030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e41d0000000100000010000000a86dc6a233eb339610f3ed414927c559140000000100000014000000ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f620000000100000020000000552f7bdcf1a7af9e6ce672017f4f12abf77240c78e761ac203d1d9d20ac899880b00000001000000320000004400690067006900430065007200740020005400720075007300740065006400200052006f006f0074002000470034000000090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000300000004ea1b34b10b982a96a38915843507820ad632c6aad8343e337b34d660cd8366fa154544ae80668ae1fdf3931d57e19962000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	utweb.exe

NTFS ADS 7 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Bonzi.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\DoubleAgent_x86_Installer.msi:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MUSH.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MASS_Setup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\CyberBuddyFREESetup.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\utweb_installer.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MSagent.exe:Zone.Identifier	firefox.exe

Script User-Agent 9 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	197	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	199	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	173	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	177	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	180	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	193	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	196	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	178	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	191	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
4720	utweb_installer.exe
4720	utweb_installer.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6524	msiexec.exe
6796	msiexec.exe
6796	msiexec.exe
6796	msiexec.exe
6796	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5168	CBsetup.exe
6324	CyberBud.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
628	Process not Found
628	Process not Found
628	Process not Found
628	Process not Found
628	Process not Found

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
3524	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	5304	utweb_installer.tmp
Token: SeDebugPrivilege	5304	utweb_installer.tmp
Token: SeDebugPrivilege	5304	utweb_installer.tmp
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeManageVolumePrivilege	5528	utweb.exe
Token: SeDebugPrivilege	5788	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5788	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5788	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	5788	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	6148	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	6148	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2152	MicrosoftEdge.exe
Token: SeDebugPrivilege	2152	MicrosoftEdge.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeDebugPrivilege	948	taskmgr.exe
Token: SeSystemProfilePrivilege	948	taskmgr.exe
Token: SeCreateGlobalPrivilege	948	taskmgr.exe
Token: 33	948	taskmgr.exe
Token: SeIncBasePriorityPrivilege	948	taskmgr.exe
Token: SeDebugPrivilege	2304	firefox.exe
Token: SeShutdownPrivilege	3768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3768	msiexec.exe
Token: SeSecurityPrivilege	6524	msiexec.exe
Token: SeCreateTokenPrivilege	3768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3768	msiexec.exe
Token: SeLockMemoryPrivilege	3768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3768	msiexec.exe
Token: SeMachineAccountPrivilege	3768	msiexec.exe
Token: SeTcbPrivilege	3768	msiexec.exe
Token: SeSecurityPrivilege	3768	msiexec.exe
Token: SeTakeOwnershipPrivilege	3768	msiexec.exe
Token: SeLoadDriverPrivilege	3768	msiexec.exe
Token: SeSystemProfilePrivilege	3768	msiexec.exe
Token: SeSystemtimePrivilege	3768	msiexec.exe
Token: SeProfSingleProcessPrivilege	3768	msiexec.exe
Token: SeIncBasePriorityPrivilege	3768	msiexec.exe
Token: SeCreatePagefilePrivilege	3768	msiexec.exe
Token: SeCreatePermanentPrivilege	3768	msiexec.exe
Token: SeBackupPrivilege	3768	msiexec.exe
Token: SeRestorePrivilege	3768	msiexec.exe
Token: SeShutdownPrivilege	3768	msiexec.exe
Token: SeDebugPrivilege	3768	msiexec.exe
Token: SeAuditPrivilege	3768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3768	msiexec.exe
Token: SeChangeNotifyPrivilege	3768	msiexec.exe
Token: SeRemoteShutdownPrivilege	3768	msiexec.exe
Token: SeUndockPrivilege	3768	msiexec.exe
Token: SeSyncAgentPrivilege	3768	msiexec.exe
Token: SeEnableDelegationPrivilege	3768	msiexec.exe
Token: SeManageVolumePrivilege	3768	msiexec.exe
Token: SeImpersonatePrivilege	3768	msiexec.exe
Token: SeCreateGlobalPrivilege	3768	msiexec.exe
Token: SeCreateTokenPrivilege	3768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3768	msiexec.exe
Token: SeLockMemoryPrivilege	3768	msiexec.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5304	utweb_installer.tmp
6036	utweb_installer.tmp
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
5528	utweb.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe
948	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2152	MicrosoftEdge.exe
3524	MicrosoftEdgeCP.exe
5788	MicrosoftEdgeCP.exe
3524	MicrosoftEdgeCP.exe
6560	MicrosoftEdgeCP.exe
2152	MicrosoftEdge.exe
2152	MicrosoftEdge.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
6100	SETLANG.EXE
6100	SETLANG.EXE
6232	WINWORD.EXE
6232	WINWORD.EXE
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
2304	firefox.exe
5704	BonziBuddy432.exe
3488	MSAGENT.EXE
1892	tv_enua.exe
6660	AgentSvr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2584 wrote to memory of 2304	2584	firefox.exe	71
PID 2304 wrote to memory of 912	2304	firefox.exe	72
PID 2304 wrote to memory of 912	2304	firefox.exe	72
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4060	2304	firefox.exe	73
PID 2304 wrote to memory of 4420	2304	firefox.exe	74
PID 2304 wrote to memory of 4420	2304	firefox.exe	74
PID 2304 wrote to memory of 4420	2304	firefox.exe	74

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://piratebay.party"
1⤵
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://piratebay.party
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.0.1488765932\21385474" -parentBuildID 20221007134813 -prefsHandle 1668 -prefMapHandle 1704 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2d2a4c75-0376-4331-ad4d-06dcfc0f31c5} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 1796 24dcc6d6a58 gpu
    3⤵
    PID:912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.1.921825275\1783638327" -parentBuildID 20221007134813 -prefsHandle 2160 -prefMapHandle 2156 -prefsLen 21608 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {73edf5ea-e960-4574-a43d-cf12d20f0eea} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 2172 24dba36fb58 socket
    3⤵
    PID:4060
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.2.1346711499\852113613" -childID 1 -isForBrowser -prefsHandle 2708 -prefMapHandle 2884 -prefsLen 21646 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {570c9f97-cf07-4357-9762-224d71887f94} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 2904 24dd09caf58 tab
    3⤵
    PID:4420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.3.423951835\965288485" -childID 2 -isForBrowser -prefsHandle 3544 -prefMapHandle 3540 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d12a666f-6001-41e3-a388-69fcb669c564} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 1232 24dcddaf058 tab
    3⤵
    PID:3328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.4.116027985\1357785417" -childID 3 -isForBrowser -prefsHandle 4912 -prefMapHandle 4908 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {45be25ce-115e-478e-a1ad-83b174bc9066} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4920 24dd3c74b58 tab
    3⤵
    PID:1132
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.5.167289733\300559100" -childID 4 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e81ca87-ad3e-4849-880b-01ccc1fd2539} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4988 24dd3ca5b58 tab
    3⤵
    PID:4504
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.6.1156350029\1084178587" -childID 5 -isForBrowser -prefsHandle 5196 -prefMapHandle 5200 -prefsLen 26343 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b1d85a4-f95b-4c14-80c0-b459e961113e} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5188 24dd3ca6158 tab
    3⤵
    PID:3608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.7.511706555\1331555839" -childID 6 -isForBrowser -prefsHandle 4508 -prefMapHandle 5196 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdc94bf7-f5b6-46c1-964f-bdbfd5d89b42} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 3080 24dba368d58 tab
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.8.1016725418\1214098454" -childID 7 -isForBrowser -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e655334-5506-47bd-b290-ac0ba4bf81e4} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5716 24dd57cd958 tab
    3⤵
    PID:4496
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.9.1145284486\3063876" -childID 8 -isForBrowser -prefsHandle 5344 -prefMapHandle 5328 -prefsLen 26768 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e763406c-eeb3-4f97-b08d-c383d099cf36} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5340 24dd5d6cd58 tab
    3⤵
    PID:5792
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.10.1568565579\51644448" -childID 9 -isForBrowser -prefsHandle 5856 -prefMapHandle 6228 -prefsLen 27468 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2459ad9e-1105-4a0a-aa2c-af2cd24b618d} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 3708 24dd560b858 tab
    3⤵
    PID:5632
- - C:\Users\Admin\Downloads\utweb_installer.exe
    "C:\Users\Admin\Downloads\utweb_installer.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\is-6CSOU.tmp\utweb_installer.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-6CSOU.tmp\utweb_installer.tmp" /SL5="$50270,866661,820736,C:\Users\Admin\Downloads\utweb_installer.exe"
      4⤵
      Executes dropped EXE
      Checks for any installed AV software in registry
      Checks processor information in registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\is-C10GC.tmp\utweb_installer.exe
        
        "C:\Users\Admin\AppData\Local\Temp\is-C10GC.tmp\utweb_installer.exe" /S
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.11.527424979\1490690453" -childID 10 -isForBrowser -prefsHandle 6088 -prefMapHandle 5872 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8179e0e0-4d2f-4821-8737-430e3db54955} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 6980 24dd2d52358 tab
    3⤵
    PID:6304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.12.23963069\1945824114" -parentBuildID 20221007134813 -prefsHandle 7396 -prefMapHandle 7332 -prefsLen 27573 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa072ed4-6629-4e33-998f-c1e705fc4335} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11392 24dd64e8858 rdd
    3⤵
    PID:6944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.13.1319404659\1021649744" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 11376 -prefMapHandle 11336 -prefsLen 27573 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {71f9d400-1354-4cd5-b31f-2715b45b71aa} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11192 24dd6e7cf58 utility
    3⤵
    PID:2312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.14.1973321752\2048733664" -childID 11 -isForBrowser -prefsHandle 11044 -prefMapHandle 11048 -prefsLen 27573 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {353c5f47-24c4-483c-9c4f-0858db87885b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11032 24dd6ed6958 tab
    3⤵
    PID:5348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.15.59314227\1696258933" -childID 12 -isForBrowser -prefsHandle 6212 -prefMapHandle 4576 -prefsLen 27591 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d92ffe05-1ad9-44d1-bdcd-af1f7e060ebd} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 3752 24dd8d58c58 tab
    3⤵
    PID:3896
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.16.756943592\256753838" -childID 13 -isForBrowser -prefsHandle 5724 -prefMapHandle 6056 -prefsLen 27591 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8dd55985-d959-45e6-bb9e-6c44339808b2} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4316 24dd8d56e58 tab
    3⤵
    PID:7120
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.17.69429777\145221200" -childID 14 -isForBrowser -prefsHandle 6124 -prefMapHandle 7048 -prefsLen 27591 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {67df8c7b-d83a-45b3-a616-b476aee55ce6} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7044 24dd2d52658 tab
    3⤵
    PID:7148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.18.1608690665\1769738864" -childID 15 -isForBrowser -prefsHandle 5604 -prefMapHandle 7092 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b0a3cf8-825f-464e-a81a-26c8f075cf07} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11004 24dd3b96558 tab
    3⤵
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.19.1277247040\77885493" -childID 16 -isForBrowser -prefsHandle 5948 -prefMapHandle 6108 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11a32799-569f-4ccf-8302-2b319f14f32b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10900 24ddca29e58 tab
    3⤵
    PID:5424
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.20.1390334110\699500546" -childID 17 -isForBrowser -prefsHandle 10592 -prefMapHandle 10596 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {080634d0-206b-48bf-93cb-79d7e41ec573} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10580 24dddc6fb58 tab
    3⤵
    PID:4648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.21.543247468\1887556278" -childID 18 -isForBrowser -prefsHandle 10664 -prefMapHandle 10652 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6780c588-271c-4729-a562-981a146e1a0e} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10448 24dddb61758 tab
    3⤵
    PID:5688
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.22.1293439392\2028203112" -childID 19 -isForBrowser -prefsHandle 10732 -prefMapHandle 7048 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6652e48-a4e0-44e1-8b97-861368185fd5} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10260 24dddfd1a58 tab
    3⤵
    PID:6312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.23.60453773\1337468662" -childID 20 -isForBrowser -prefsHandle 10188 -prefMapHandle 9844 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30349528-5be6-469f-8596-fb3a1cafcebc} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9840 24dde805d58 tab
    3⤵
    PID:6156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.24.1668704670\1481036627" -childID 21 -isForBrowser -prefsHandle 10172 -prefMapHandle 10180 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {927f0870-8c4e-4f2d-8ffe-3db3349be917} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10100 24dde79bf58 tab
    3⤵
    PID:5672
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.25.1689160248\1866694613" -childID 22 -isForBrowser -prefsHandle 5904 -prefMapHandle 6992 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {503bf705-ab89-4de3-8311-677f7c696b8a} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7120 24dde8f5f58 tab
    3⤵
    PID:5480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.26.874044420\1121568045" -childID 23 -isForBrowser -prefsHandle 10456 -prefMapHandle 10140 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e542c33-2c02-410c-a0b4-3eb5fe95c0e7} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10256 24ddde8d958 tab
    3⤵
    PID:4368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.27.1814177\1414875755" -childID 24 -isForBrowser -prefsHandle 9552 -prefMapHandle 9840 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03a34484-489a-4ee9-944c-312e16e4195c} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10304 24dde048158 tab
    3⤵
    PID:7116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.28.2085968574\362409006" -childID 25 -isForBrowser -prefsHandle 6432 -prefMapHandle 6900 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ce2d5f0-7fbb-4e7f-ae8d-b6f5e022ae0d} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5596 24ddc274558 tab
    3⤵
    PID:6140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.29.76610890\1003310375" -childID 26 -isForBrowser -prefsHandle 10576 -prefMapHandle 3724 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {10e6a7ae-68d1-4ba1-9384-ceb2bc423d4b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 6900 24ddc27b558 tab
    3⤵
    PID:6444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.30.1833216711\1564582007" -childID 27 -isForBrowser -prefsHandle 10340 -prefMapHandle 9616 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {89e9d6f8-3557-4337-9775-b66af777b38a} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 6900 24ddeb05458 tab
    3⤵
    PID:6184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.31.1358532466\1723843027" -childID 28 -isForBrowser -prefsHandle 9968 -prefMapHandle 10228 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e0467bbf-7831-4b0d-8188-70925a5b1a1c} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9708 24ddeb06f58 tab
    3⤵
    PID:4628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.32.747767592\1079457139" -childID 29 -isForBrowser -prefsHandle 10344 -prefMapHandle 9708 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e955a6d-edca-4fdd-9cf3-9ae8c85b9c76} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10220 24dde9c5e58 tab
    3⤵
    PID:7148
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.33.1131813535\2089039414" -childID 30 -isForBrowser -prefsHandle 10852 -prefMapHandle 11040 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba3ae0c5-c2f3-46e1-a2ce-33d26f671f8c} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 3452 24ddd9eda58 tab
    3⤵
    PID:1760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.34.850781152\1110642423" -childID 31 -isForBrowser -prefsHandle 7240 -prefMapHandle 6108 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6030c88-aa20-4e3d-ae7b-dc03c2b916c1} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10168 24dd5cf9558 tab
    3⤵
    PID:5696
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.35.617245773\951274118" -childID 32 -isForBrowser -prefsHandle 10060 -prefMapHandle 10700 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d1381a14-78fc-4dd6-b402-bee272a2e2bf} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4908 24ddd9bef58 tab
    3⤵
    PID:4524
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.36.328262554\117042998" -childID 33 -isForBrowser -prefsHandle 7092 -prefMapHandle 5944 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {aa539161-a701-4c71-8429-e982f41ac60e} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9976 24ddd2eff58 tab
    3⤵
    PID:2516
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.37.1462711394\1967102151" -childID 34 -isForBrowser -prefsHandle 3992 -prefMapHandle 3996 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4a4e67f6-38cf-46e5-877b-81246fd2a70e} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10672 24ddfce2558 tab
    3⤵
    PID:5736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.38.364649667\1209363197" -childID 35 -isForBrowser -prefsHandle 10444 -prefMapHandle 10792 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a5a4648a-0985-44d1-bfe4-12ead251ce87} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10160 24ddfce2558 tab
    3⤵
    PID:6468
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.39.1046635003\1558288521" -childID 36 -isForBrowser -prefsHandle 10992 -prefMapHandle 7180 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ddd92806-0ee1-4b67-8021-6b572d09a025} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7248 24ddfecf758 tab
    3⤵
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.40.329659837\668934372" -childID 37 -isForBrowser -prefsHandle 9940 -prefMapHandle 5616 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59472858-b1eb-479c-8d93-a392d2b1c2aa} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7180 24de0516558 tab
    3⤵
    PID:5340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.41.668797443\764209897" -childID 38 -isForBrowser -prefsHandle 11028 -prefMapHandle 7228 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {365362e8-eb52-4904-b700-6f53b1f26a84} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7184 24de0092e58 tab
    3⤵
    PID:6016
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.42.978637320\811918343" -childID 39 -isForBrowser -prefsHandle 10020 -prefMapHandle 6940 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {08eb40b8-39d8-4e11-a415-7d3ee69456e0} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4460 24de0a59a58 tab
    3⤵
    PID:4736
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.43.1325306057\1193357725" -childID 40 -isForBrowser -prefsHandle 9728 -prefMapHandle 10892 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6947ecc-3540-4ca2-976b-c1f40b88eb58} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10192 24de0a70f58 tab
    3⤵
    PID:3212
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.44.1050965437\2049241068" -childID 41 -isForBrowser -prefsHandle 10064 -prefMapHandle 10040 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {50c378f5-20d1-44b0-820c-f5aa72db6ef3} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10928 24de0324758 tab
    3⤵
    PID:2968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.45.1974434788\833423591" -childID 42 -isForBrowser -prefsHandle 10792 -prefMapHandle 7328 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5cc4721e-4696-4022-8ef6-f21779ad5888} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7388 24dd969b158 tab
    3⤵
    PID:6748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.46.1503113922\1291603764" -childID 43 -isForBrowser -prefsHandle 4908 -prefMapHandle 10992 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {202a04f6-d03c-4fed-b72f-2620136cc113} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 4328 24de1e16158 tab
    3⤵
    PID:5976
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.47.1549451936\1441396866" -childID 44 -isForBrowser -prefsHandle 7320 -prefMapHandle 4524 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {34f4d649-24cf-4421-a062-bd4a4b8ea971} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5928 24de25a1758 tab
    3⤵
    PID:6660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.48.1975918342\843819632" -childID 45 -isForBrowser -prefsHandle 5628 -prefMapHandle 6068 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {44e8e1e0-cbe4-42f1-9824-e9889cdb8182} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10064 24de2855558 tab
    3⤵
    PID:6984
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.49.1452867195\425697622" -childID 46 -isForBrowser -prefsHandle 10064 -prefMapHandle 7316 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecd80800-8ef7-4afc-93a8-df2c70f75d6b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7188 24de28d5158 tab
    3⤵
    PID:1632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.50.1902710476\1413887822" -childID 47 -isForBrowser -prefsHandle 10276 -prefMapHandle 10064 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bf88c16-526e-46a2-81ff-f2f40cbfe191} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5348 24de2c71c58 tab
    3⤵
    PID:5012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.51.831931171\920707013" -childID 48 -isForBrowser -prefsHandle 7376 -prefMapHandle 10884 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0f80aab-e9fb-4dcd-a8e0-9242ec4d12f7} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10252 24de2e3ed58 tab
    3⤵
    PID:2980
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.52.1880585127\1945459731" -childID 49 -isForBrowser -prefsHandle 3988 -prefMapHandle 9816 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5688aea3-fda9-4103-8cc8-929845d8b5a4} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9792 24de333e258 tab
    3⤵
    PID:3580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.53.581393092\286735737" -childID 50 -isForBrowser -prefsHandle 9684 -prefMapHandle 9732 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64b8373c-a47f-47a8-bf8f-116b7a18ad41} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9664 24de38ed858 tab
    3⤵
    PID:2992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.54.89396869\143589024" -childID 51 -isForBrowser -prefsHandle 10520 -prefMapHandle 10620 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1687584-c1e2-4aea-aeb9-2946e646c384} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 7452 24de1e81858 tab
    3⤵
    PID:3512
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.55.1861945074\1260264477" -childID 52 -isForBrowser -prefsHandle 10520 -prefMapHandle 10620 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {30485211-ac6a-46c8-9e3f-f4f0b0f054e3} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9292 24de3cbae58 tab
    3⤵
    PID:2916
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.56.123705646\1129282485" -childID 53 -isForBrowser -prefsHandle 9224 -prefMapHandle 9220 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {72649999-1d59-4608-9140-e635cc6eac7a} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9232 24de38f0e58 tab
    3⤵
    PID:4888
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.57.1382126136\916330748" -childID 54 -isForBrowser -prefsHandle 9300 -prefMapHandle 5728 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa688526-2d58-4b63-9a3c-167c540464b0} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10220 24de3884458 tab
    3⤵
    PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.58.1258489388\1092798353" -childID 55 -isForBrowser -prefsHandle 9408 -prefMapHandle 9412 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cac0b5e2-f860-494e-a6c9-bc8fc3d5812d} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11360 24de31ba558 tab
    3⤵
    PID:6020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.59.1500332420\299996231" -childID 56 -isForBrowser -prefsHandle 1308 -prefMapHandle 9332 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db870b9b-24e7-4120-8dd6-6a1a06b6603b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11360 24de46b2658 tab
    3⤵
    PID:3596
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.60.454599894\322027869" -childID 57 -isForBrowser -prefsHandle 8884 -prefMapHandle 8880 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97be67ec-8773-490d-85d5-d0d64454ac2b} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 9208 24de4914958 tab
    3⤵
    PID:1892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.61.1384369748\1386199559" -childID 58 -isForBrowser -prefsHandle 9420 -prefMapHandle 9436 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1231e989-ec20-4daa-b5d5-da38c9cc43a4} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 11024 24de4b8c158 tab
    3⤵
    PID:6480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.62.932587744\558752950" -childID 59 -isForBrowser -prefsHandle 7192 -prefMapHandle 8980 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a002202-c2e9-414e-88c3-96150eb7ffe3} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 8972 24de0137958 tab
    3⤵
    PID:4632
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.63.470192132\1043714514" -childID 60 -isForBrowser -prefsHandle 4328 -prefMapHandle 9292 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef6a5d90-3bd5-4aee-a1ea-6e39e867d78f} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 5088 24de5606258 tab
    3⤵
    PID:6996
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.64.578722455\1104627638" -childID 61 -isForBrowser -prefsHandle 10168 -prefMapHandle 10600 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4309d398-37cc-48ad-b7ff-368cde8397f3} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 6892 24dba35e258 tab
    3⤵
    PID:1656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.65.1692770781\1972098616" -childID 62 -isForBrowser -prefsHandle 11004 -prefMapHandle 5112 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f5ce404-c6e9-4835-9870-a3c203a8f6c4} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 6216 24dba365c58 tab
    3⤵
    PID:1884
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2304.66.72856719\771970676" -childID 63 -isForBrowser -prefsHandle 9840 -prefMapHandle 4448 -prefsLen 27752 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed7a186a-549d-4b04-bdd4-5bc174c72f52} 2304 "\\.\pipe\gecko-crash-server-pipe.2304" 10156 24dba36b258 tab
    3⤵
    PID:3880

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:3480

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:5460

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5364

C:\Users\Admin\Downloads\utweb_installer.exe
"C:\Users\Admin\Downloads\utweb_installer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5656
- C:\Users\Admin\AppData\Local\Temp\is-544EK.tmp\utweb_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-544EK.tmp\utweb_installer.tmp" /SL5="$C01D0,866661,820736,C:\Users\Admin\Downloads\utweb_installer.exe"
  2⤵
  - Executes dropped EXE
  PID:5684

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:5944

C:\Users\Admin\Downloads\utweb_installer.exe
"C:\Users\Admin\Downloads\utweb_installer.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6004
- C:\Users\Admin\AppData\Local\Temp\is-D5CD5.tmp\utweb_installer.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-D5CD5.tmp\utweb_installer.tmp" /SL5="$70356,866661,820736,C:\Users\Admin\Downloads\utweb_installer.exe"
  2⤵
  - Executes dropped EXE
  - Checks for any installed AV software in registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Suspicious use of FindShellTrayWindow
  PID:6036
- - C:\Users\Admin\AppData\Local\Temp\is-DF7JI.tmp\utweb_installer.exe
    "C:\Users\Admin\AppData\Local\Temp\is-DF7JI.tmp\utweb_installer.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    PID:4720
- - C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe
    "C:\Users\Admin\AppData\Roaming\uTorrent Web\utweb.exe" /RUNONSTARTUP
    3⤵
    - Checks computer location settings
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies system certificate store
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:5528

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2152

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:60

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:3524

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5788

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5648

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:6560

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:6148

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:5296

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:6212

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:6724

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:1660

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:3176

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:5036

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:948

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:4728

C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\SETUP.EXE
"C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\SETUP.EXE"
1⤵
PID:3512
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /I "C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\PROPLUS.MSI" SKIPOSPCHECK=1 METRICSSOURCE="C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)" LAUNCHEDFROMSETUP=1 SETUPEXEPATH="C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\" /lvpiwaeo "C:\Users\Admin\AppData\Local\Temp\Office XP Professional with FrontPage Setup(0001)_Task(0001).txt" LOGVERBOSE=1 DWSETUPLOGFILE="C:\Users\Admin\AppData\Local\Temp\Office XP Professional with FrontPage Setup(0001).txt" DWMSILOGFILE="C:\Users\Admin\AppData\Local\Temp\Office XP Professional with FrontPage Setup(0001)_Task(0001).txt"
  2⤵
  - Enumerates connected drives
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:3768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Manipulates Digital Signatures
- Adds Run key to start application
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6524
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C2F3F9FC0131DF202C98F8206D912CEC C
  2⤵
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:6320
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4524
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2E1FFC1994EE85CE4030CC849214A9DA
  2⤵
  - Loads dropped DLL
  PID:2136
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F9C77C7893EB76D06B8FFABD01B2B3EA E Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:7072
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E5C0C00BAA457FFA4F937780C96D0AA6 M Global\MSI0000
  2⤵
  - Modifies registry class
  PID:6596
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Windows\SysWOW64\FM20.DLL"
  2⤵
  - Modifies registry class
  PID:5384
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Microsoft Office\Office10\1033\MSRCLR40.DLL"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3936
- C:\Program Files (x86)\Microsoft Office\Office10\msohtmed.exe
  "C:\Program Files (x86)\Microsoft Office\Office10\msohtmed.exe" /regserverfp
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3580
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E9F4A03A41284AC40770A57C9DDC0787
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3376
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding E022FDE6D6B4F9E8974E3AA8B59D1922 E Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  PID:2980
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 664A5B35760FD9E14AF505C8015C4908
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6828
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding CC4050E84B05E3E7D1CD40512EF6F91A E Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  PID:2584
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8F581B0923D3E49AB0F3F8D95939AE56
  2⤵
  PID:5308
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3C6B403D880B51371F4CA7671642B7D6 E Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:2676

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\cd-key.txt
1⤵
PID:6628

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\Microsoft Office Xp Pro (Word, Excel, Powerpoint, Outlook, Access, Frontpage, Publisher 2003)\cd-key.txt
1⤵
PID:2172

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:6844

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:1044

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s DsmSvc
1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:6272

C:\Program Files (x86)\Microsoft Office\Office10\SETLANG.EXE
"C:\Program Files (x86)\Microsoft Office\Office10\SETLANG.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6100

C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6232

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DeviceAssociationService
1⤵
PID:6140

C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe
C:\Windows\System32\Speech_OneCore\Common\SpeechRuntime.exe -Embedding
1⤵
PID:608

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3620

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6244

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5496

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4720

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6820

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:6072

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6368

C:\Users\Admin\Desktop\MSagent.exe
"C:\Users\Admin\Desktop\MSagent.exe"
1⤵
- Executes dropped EXE
PID:5628

C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Bonzi.zip\BonziBuddy432.exe"
1⤵
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6032
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
    MSAGENT.EXE
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3488
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:5552
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      PID:3580
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5148
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2408
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      PID:5224
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6376
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:6660
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:3420
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
    tv_enua.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1892
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      PID:6600
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:6276

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:3180

C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE"
1⤵
- Executes dropped EXE
PID:7012

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5152

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2d0
1⤵
PID:6816

C:\Windows\System32\msiexec.exe
"C:\Windows\System32\msiexec.exe" /i "C:\Users\Admin\Downloads\DoubleAgent_x86_Installer.msi"
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
PID:1008
- C:\Program Files (x86)\Double Agent\DaServer.exe
  "C:\Program Files (x86)\Double Agent\DaServer.exe" -settings
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6660

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:6796
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding B0014E105EDB5A973699774F426BE135 M Global\MSI0000
  2⤵
  - System Location Discovery: System Language Discovery
  PID:356
- C:\Windows\syswow64\MsiExec.exe
  "C:\Windows\syswow64\MsiExec.exe" /Y "C:\Program Files (x86)\Double Agent\DaShell.dll"
  2⤵
  PID:5780
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F713A17250B4F8233E96AEC21C11DDD3 C
  2⤵
  PID:5008
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BDDA5F6358CC8A1591060902B145177E
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3768
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BA4ABB05D2E9BC944634C0FB1DB0FB8B E Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  - System Location Discovery: System Language Discovery
  PID:6976

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5112

C:\Program Files (x86)\Double Agent\DaServer.exe
"C:\Program Files (x86)\Double Agent\DaServer.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4388

C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office10\WINWORD.EXE"
1⤵
- Executes dropped EXE
- Enumerates connected drives
PID:3012

C:\Program Files (x86)\Double Agent\DaServer.exe
"C:\Program Files (x86)\Double Agent\DaServer.exe" -Embedding
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068

C:\Users\Admin\Downloads\MUSH.exe
"C:\Users\Admin\Downloads\MUSH.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6444

C:\Users\Admin\Downloads\CyberBuddyFREESetup.exe
"C:\Users\Admin\Downloads\CyberBuddyFREESetup.exe"
1⤵
- Executes dropped EXE
- Drops autorun.inf file
PID:5696
- C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\CBsetup.exe
  .\CBsetup.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  PID:5168
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\MSagent.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\MSagent.exe /Q:A
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      PID:5792
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      PID:5672
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      PID:4416
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:6612
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3600
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:6116
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\tv_enua.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\tv_enua.exe /Q:A
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Adds Run key to start application
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    PID:4464
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:6840
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      System Location Discovery: System Language Discovery
      PID:5132
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      PID:7104
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\spchcpl.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\spchcpl.exe /Q:A
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in System32 directory
    - System Location Discovery: System Language Discovery
    PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.exe
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\spchapi.exe /q:a
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      PID:2104
    - - C:\Windows\SysWOW64\grpconv.exe
        
        grpconv.exe -o
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3852
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:360
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\msttsa22L.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\msttsa22L.exe /Q:A
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Drops file in Windows directory
    PID:1936
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:1224
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\merlin.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\merlin.exe /Q:A
    3⤵
    - Executes dropped EXE
    PID:2276
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Merlin.inf
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:6844
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:6372
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, RemoveCabinet
        6⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Windows directory
        
        PID:4444
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4664
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\genie.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\genie.exe /Q:A
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:6268
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\genie.inf
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        Checks processor information in registry
        
        PID:5300
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6068
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\peedy.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\peedy.exe /Q:A
    3⤵
    - Executes dropped EXE
    PID:7048
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Peedy.inf
      4⤵
      Adds Run key to start application
      PID:5640
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2832
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
- - C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\robby.exe
    C:\Users\Admin\AppData\Local\Temp\7zS65BB.tmp\robby.exe /Q:A
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5068
  - - C:\Windows\SysWOW64\rundll32.exe
      rundll32.exe setupapi.dll,InstallHinfSection DefaultInstall 128 C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Robby.inf
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:2884
    - - C:\Windows\SysWOW64\runonce.exe
        
        "C:\Windows\system32\runonce.exe" -r
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2748
      - C:\Windows\SysWOW64\grpconv.exe
        
        "C:\Windows\System32\grpconv.exe" -o
        6⤵
        
        PID:6344

C:\Apps\CyberBuddy\CyberBud.exe
"C:\Apps\CyberBuddy\CyberBud.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:6324

C:\Apps\CyberBuddy\CyberBud.exe
"C:\Apps\CyberBuddy\CyberBud.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:64

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

SIP and Trust Provider Hijacking

T1553.003

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery