Analysis
-
max time kernel
1800s -
max time network
1800s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
02-10-2024 18:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gta-6.en.softonic.com/
Resource
win11-20240802-en
crimsonratnetwirenjratrevengeratbootkitbotnetcredential_accessdefense_evasiondiscoveryevasionpersistenceprivilege_escalationratspywarestealertrojan
windows11-21h2-x64
66 signatures
1800 seconds
General
-
Target
https://gta-6.en.softonic.com/
Malware Config
Extracted
Family
crimsonrat
C2
185.136.161.124
Signatures
-
CrimsonRAT main payload 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000100000002b6d4-16683.dat family_crimsonrat -
CrimsonRat
Crimson RAT is a malware linked to a Pakistani-linked threat actor.
-
Modifies WinLogon for persistence 2 TTPs 5 IoCs
Processes:
winupdate.exewinupdate.exewinupdate.exewinupdate.exeBlackkomet.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\winupdate.exe" Blackkomet.exe -
RevengeRAT
Remote-access trojan with a wide range of capabilities.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
avDump.exedescription pid Process procid_target PID 1060 created 6848 1060 avDump.exe 143 -
Processes:
reg.exereg.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
RevengeRat Executable 1 IoCs
Processes:
resource yara_rule behavioral1/files/0x000c00000002b700-17817.dat revengerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
MSAGENT.EXEtv_enua.exedescription ioc Process Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components MSAGENT.EXE Key created \REGISTRY\MACHINE\software\WOW6432Node\microsoft\Active Setup\Installed Components tv_enua.exe -
Downloads MZ/PE file
-
Drops file in Drivers directory 60 IoCs
Processes:
instup.exedescription ioc Process File opened for modification C:\Windows\system32\drivers\aswNetHub.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswRdr2.sys instup.exe File created C:\Windows\system32\drivers\aswElam.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswa267baccef8e7a09.tmp instup.exe File created C:\Windows\system32\drivers\asw8a24180ce009d8c4.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswArDisk.sys instup.exe File created C:\Windows\system32\drivers\aswArPot.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswa73ce92b3b77ff2d.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw37ac77963a74e3be.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswbidsdriver.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswSP.sys instup.exe File created C:\Windows\system32\drivers\aswVmm.sys instup.exe File created C:\Windows\system32\drivers\aswa73ce92b3b77ff2d.tmp instup.exe File created C:\Windows\system32\drivers\asw34814da41daa97d2.tmp instup.exe File created C:\Windows\system32\drivers\aswbidsdriver.sys instup.exe File created C:\Windows\system32\drivers\asw472e19d116994437.tmp instup.exe File created C:\Windows\system32\drivers\asw37ac77963a74e3be.tmp instup.exe File created C:\Windows\system32\drivers\aswbuniv.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswStm.sys instup.exe File created C:\Windows\system32\drivers\aswArDisk.sys instup.exe File created C:\Windows\system32\drivers\aswRvrt.sys instup.exe File created C:\Windows\system32\drivers\aswSP.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw0156cb1aa5e4adfd.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswb56886c87b8d0b96.tmp instup.exe File created C:\Windows\system32\drivers\asw017f303df98f2e70.tmp instup.exe File created C:\Windows\system32\drivers\aswa1e65eb4b597dae7.tmp instup.exe File created C:\Windows\system32\drivers\aswea2f8e009b05a9ad.tmp instup.exe File created C:\Windows\system32\drivers\aswb56886c87b8d0b96.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswElam.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswbuniv.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswVmm.sys instup.exe File created C:\Windows\system32\drivers\aswSnx.sys instup.exe File created C:\Windows\system32\drivers\aswMonFlt.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw21cf0e83ef928bfa.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw0a076b0cfe8c834f.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw8a24180ce009d8c4.tmp instup.exe File created C:\Windows\system32\drivers\asw0f64b4b9967d9e55.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswea2f8e009b05a9ad.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswbidsh.sys instup.exe File opened for modification C:\Windows\system32\drivers\aswKbd.sys instup.exe File created C:\Windows\system32\drivers\aswNetHub.sys instup.exe File created C:\Windows\system32\drivers\aswbidsh.sys instup.exe File created C:\Windows\system32\drivers\aswStm.sys instup.exe File created C:\Windows\system32\drivers\asw21cf0e83ef928bfa.tmp instup.exe File created C:\Windows\system32\drivers\aswef3bae9d56877d97.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswSnx.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw472e19d116994437.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswArPot.sys instup.exe File created C:\Windows\system32\drivers\asw0a076b0cfe8c834f.tmp instup.exe File created C:\Windows\system32\drivers\asw0156cb1aa5e4adfd.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswMonFlt.sys instup.exe File created C:\Windows\system32\drivers\aswRdr2.sys instup.exe File created C:\Windows\system32\drivers\aswa267baccef8e7a09.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswa1e65eb4b597dae7.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswef3bae9d56877d97.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw34814da41daa97d2.tmp instup.exe File opened for modification C:\Windows\system32\drivers\aswRvrt.sys instup.exe File created C:\Windows\system32\drivers\aswKbd.sys instup.exe File opened for modification C:\Windows\system32\drivers\asw0f64b4b9967d9e55.tmp instup.exe File opened for modification C:\Windows\system32\drivers\asw017f303df98f2e70.tmp instup.exe -
Modifies Windows Firewall 2 TTPs 1 IoCs
Processes:
netsh.exepid Process 8508 netsh.exe -
Sets file to hidden 1 TTPs 10 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid Process 4920 attrib.exe 6512 attrib.exe 4304 attrib.exe 8544 attrib.exe 2984 attrib.exe 5968 attrib.exe 7748 attrib.exe 5688 attrib.exe 9200 attrib.exe 5248 attrib.exe -
Sets service image path in registry 2 TTPs 15 IoCs
Processes:
instup.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArPot\ImagePath = "system32\\drivers\\aswArPot.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRdr\ImagePath = "system32\\drivers\\aswRdr2.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswMonFlt\ImagePath = "system32\\drivers\\aswMonFlt.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsh\ImagePath = "system32\\drivers\\aswbidsh.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswVmm\ImagePath = "system32\\drivers\\aswVmm.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSnx\ImagePath = "system32\\drivers\\aswSnx.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswNetHub\ImagePath = "system32\\drivers\\aswNetHub.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswElam\ImagePath = "system32\\drivers\\aswElam.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswSP\ImagePath = "system32\\drivers\\aswSP.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbuniv\ImagePath = "system32\\drivers\\aswbuniv.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswbidsdriver\ImagePath = "system32\\drivers\\aswbidsdriver.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswRvrt\ImagePath = "system32\\drivers\\aswRvrt.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswArDisk\ImagePath = "system32\\drivers\\aswArDisk.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswKbd\ImagePath = "system32\\drivers\\aswKbd.sys" instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\aswStm\ImagePath = "system32\\drivers\\aswStm.sys" instup.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AvastUI.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Control Panel\International\Geo\Nation AvastUI.exe -
Drops startup file 6 IoCs
Processes:
RegSvcs.exeNJRat.exeRegSvcs.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe RegSvcs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe NJRat.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b9584a316aeb9ca9b31edd4db18381f5.exe\:Zone.Identifier:$DATA NJRat.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe RegSvcs.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe\:Zone.Identifier:$DATA RegSvcs.exe -
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE 51 IoCs
Processes:
avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeAvastNM.exeSetupInf.exeoverseer.exeengsup.exewsc_proxy.exeavDump.exeengsup.exeAvastUI.exeAvastUI.exeAvastUI.exeMSAGENT.EXEtv_enua.exeAgentSvr.exeBonziBDY_4.EXEAgentSvr.exewinupdate.exewinupdate.exewinupdate.exewinupdate.exedlrarhsiva.exeUserdata.exeServer.exe6AdwCleaner.exesvchost.exeBonziBDY_35.EXEsvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid Process 1076 avast_free_antivirus_setup_online.exe 5576 avast_free_antivirus_setup_online_x64.exe 3804 instup.exe 3552 instup.exe 6032 aswOfferTool.exe 6072 aswOfferTool.exe 6132 aswOfferTool.exe 5136 aswOfferTool.exe 1736 sbr.exe 4328 SetupInf.exe 808 SetupInf.exe 3316 SetupInf.exe 5460 SetupInf.exe 5188 SetupInf.exe 2956 AvEmUpdate.exe 876 AvEmUpdate.exe 6912 RegSvr.exe 1804 RegSvr.exe 6072 AvastNM.exe 5080 SetupInf.exe 4564 overseer.exe 6876 engsup.exe 6848 wsc_proxy.exe 1060 avDump.exe 4524 engsup.exe 6360 AvastUI.exe 6676 AvastUI.exe 5392 AvastUI.exe 8372 MSAGENT.EXE 1272 tv_enua.exe 6316 AgentSvr.exe 5400 BonziBDY_4.EXE 3632 AgentSvr.exe 1076 winupdate.exe 5404 winupdate.exe 7896 winupdate.exe 9012 winupdate.exe 224 dlrarhsiva.exe 6944 Userdata.exe 4908 Server.exe 2152 6AdwCleaner.exe 7432 svchost.exe 1112 BonziBDY_35.EXE 8708 svchost.exe 8340 svchost.exe 8848 svchost.exe 6268 svchost.exe 7932 svchost.exe 3144 svchost.exe 1520 svchost.exe 3472 svchost.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 2 IoCs
Processes:
instup.exedescription ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys instup.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\aswSP.sys\ = "Driver" instup.exe -
Loads dropped DLL 64 IoCs
Processes:
avast_free_antivirus_setup_online.exeinstup.exeinstup.exeaswOfferTool.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeengsup.exewsc_proxy.exeengsup.exeAvastUI.exepid Process 1076 avast_free_antivirus_setup_online.exe 3804 instup.exe 3804 instup.exe 3804 instup.exe 3804 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 5136 aswOfferTool.exe 876 AvEmUpdate.exe 876 AvEmUpdate.exe 876 AvEmUpdate.exe 876 AvEmUpdate.exe 876 AvEmUpdate.exe 6912 RegSvr.exe 1804 RegSvr.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 6876 engsup.exe 2764 3552 instup.exe 6848 wsc_proxy.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 4524 engsup.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
-
Uses the VBS compiler for execution 1 TTPs
-
Processes:
instup.exedescription ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} instup.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{8EA8924E-BC81-DC44-8BB0-8BAE75D86EBF} instup.exe -
Adds Run key to start application 2 TTPs 20 IoCs
Processes:
Blackkomet.exeUserdata.exeNJRat.exe6AdwCleaner.exeinstup.exewinupdate.exewinupdate.exeServer.exetv_enua.exewinupdate.exenotepad.exewinupdate.exeNetWire.exeRegSvcs.exenotepad.exeRemcos.exeVanToM-Rat.batnotepad.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" Blackkomet.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\"" Userdata.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\RAT\\NJRat.exe\" .." NJRat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\AdwCleaner = "\"C:\\Users\\Admin\\AppData\\Local\\6AdwCleaner.exe\" -auto" 6AdwCleaner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\AvRepair = "\"C:\\Program Files\\Avast Software\\Avast\\setup\\instup.exe\" /instop:repair /wait" instup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\b9584a316aeb9ca9b31edd4db18381f5 = "\"C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\RAT\\NJRat.exe\" .." NJRat.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\AppData\\Roaming\\VanToM Folder\\Server.exe" Server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet" tv_enua.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" winupdate.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Qspt = "C:\\Users\\Admin\\AppData\\Local\\Qspt\\Qspt.hta" NetWire.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\svchost.exe" RegSvcs.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AvastUI.exe = "\"C:\\Program Files\\Avast Software\\Avast\\AvLaunch.exe\" /gui" instup.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\remcos = "\"C:\\Windows\\SysWOW64\\Userdata\\Userdata.exe\"" Remcos.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\Server = "C:\\Users\\Admin\\Downloads\\The-MALWARE-Repo-master\\The-MALWARE-Repo-master\\RAT\\VanToM-Rat.bat" VanToM-Rat.bat Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\winupdate.exe" notepad.exe -
Checks for any installed AV software in registry 1 TTPs 64 IoCs
Processes:
AvastUI.exeinstup.exeSetupInf.exeAvEmUpdate.exewsc_proxy.exewinupdate.exeinstup.exeSetupInf.exeAvEmUpdate.exeSetupInf.exeAvastUI.exeSetupInf.exeAvastUI.exewinupdate.exewinupdate.exeRegSvr.exeSetupInf.exeSetupInf.exeRegSvr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\OPM AvastUI.exe Key value queried \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Avast Software\Avast\developer AvastUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\MovedFolder AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode wsc_proxy.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\ignore_securedns_off AvastUI.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\semo winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder instup.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense SetupInf.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\TempFolder AvastUI.exe Key enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder SetupInf.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvEmUpdate.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode winupdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\Backup winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\PropertySilent instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DDL AvastUI.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ChestFolder SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SZBProgramFolder SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common RegSvr.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages SetupInf.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings SetupInf.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties AvastUI.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings\Scanner AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\config AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\JournalFolder AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\FwDataFolder SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion RegSvr.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages RegSvr.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder RegSvr.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\semo winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupFolder winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\WebGLEnabled AvastUI.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\IDP AvastUI.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\SoftTrialActivated = "0" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense instup.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\SetupVersion SetupInf.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\CrashGuard AvastUI.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\WebShield AvastUI.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages RegSvr.exe Key opened \REGISTRY\MACHINE\Software\AVAST Software\Avast\properties\settings SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\UserInterface winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LicenseFile SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\PassiveMode SetupInf.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Languages AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\Common\PasswordEnabled AvastUI.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\DataFolder winupdate.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\LogFolder SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\ReportFolder SetupInf.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\UpdateVersion AvEmUpdate.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avast Software\Avast\properties\settings\SelfDefense RegSvr.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 18 IoCs
Processes:
flow ioc 785 0.tcp.ngrok.io 785 drive.google.com 1033 0.tcp.ngrok.io 1049 0.tcp.ngrok.io 1176 0.tcp.ngrok.io 44 raw.githubusercontent.com 787 drive.google.com 818 0.tcp.ngrok.io 979 0.tcp.ngrok.io 774 0.tcp.ngrok.io 912 0.tcp.ngrok.io 1003 0.tcp.ngrok.io 1137 0.tcp.ngrok.io 1 camo.githubusercontent.com 886 0.tcp.ngrok.io 914 0.tcp.ngrok.io 1082 0.tcp.ngrok.io 1105 0.tcp.ngrok.io -
Writes to the Master Boot Record (MBR) 1 TTPs 23 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
instup.exeoverseer.exeAvastUI.exeBlackkomet.exeavast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeAvastUI.exewinupdate.exeSetupInf.exeSetupInf.exeSetupInf.exewsc_proxy.exewinupdate.exewinupdate.exeSetupInf.exeSetupInf.exeAvastUI.exewinupdate.exeinstup.exeSetupInf.exedescription ioc Process File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 overseer.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 Blackkomet.exe File opened for modification \??\PhysicalDrive0 avast_free_antivirus_setup_online.exe File opened for modification \??\PhysicalDrive0 avast_free_antivirus_setup_online_x64.exe File opened for modification \??\PhysicalDrive0 AvEmUpdate.exe File opened for modification \??\PhysicalDrive0 RegSvr.exe File opened for modification \??\PhysicalDrive0 RegSvr.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 winupdate.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 wsc_proxy.exe File opened for modification \??\PhysicalDrive0 winupdate.exe File opened for modification \??\PhysicalDrive0 winupdate.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe File opened for modification \??\PhysicalDrive0 AvastUI.exe File opened for modification \??\PhysicalDrive0 winupdate.exe File opened for modification \??\PhysicalDrive0 instup.exe File opened for modification \??\PhysicalDrive0 SetupInf.exe -
Drops file in System32 directory 39 IoCs
Processes:
winupdate.exewinupdate.exewinupdate.exeUserdata.exenotepad.exeattrib.exeinstup.exetv_enua.exeBlackkomet.exewinupdate.exeRemcos.exenotepad.exeattrib.exeattrib.exenotepad.exeattrib.exeSetupInf.exeattrib.exeattrib.exeattrib.exeattrib.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\remcos\logs.dat Userdata.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\system32\asw418f2206c2cdfdd2.tmp instup.exe File opened for modification C:\Windows\SysWOW64\SETFEF2.tmp tv_enua.exe File created C:\Windows\SysWOW64\SETFEF2.tmp tv_enua.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe Blackkomet.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Userdata\Userdata.exe:Zone.Identifier:$DATA Remcos.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ Blackkomet.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ winupdate.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe notepad.exe File opened for modification C:\Windows\SysWOW64\remcos\logs.dat Userdata.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File opened for modification C:\Windows\System32\CatRoot2\dberr.txt SetupInf.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe Blackkomet.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe:Zone.Identifier:$DATA Blackkomet.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Userdata\Userdata.exe Remcos.exe File opened for modification C:\Windows\SysWOW64\Userdata\Userdata.exe Remcos.exe File opened for modification C:\Windows\SysWOW64\Userdata Remcos.exe File opened for modification C:\Windows\SysWOW64\msvcp50.dll tv_enua.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\system32\asw418f2206c2cdfdd2.tmp instup.exe File opened for modification C:\Windows\SysWOW64\Windupdt attrib.exe File created C:\Windows\SysWOW64\Windupdt\winupdate.exe winupdate.exe File opened for modification C:\Windows\SysWOW64\Windupdt\winupdate.exe attrib.exe -
Suspicious use of SetThreadContext 23 IoCs
Processes:
RevengeRAT.exeRegSvcs.exeNetWire.exeRevengeRAT.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exesvchost.exeRegSvcs.exedescription pid Process procid_target PID 3328 set thread context of 404 3328 RevengeRAT.exe 338 PID 404 set thread context of 8588 404 RegSvcs.exe 339 PID 5988 set thread context of 7452 5988 NetWire.exe 375 PID 5720 set thread context of 1460 5720 RevengeRAT.exe 412 PID 1460 set thread context of 7220 1460 RegSvcs.exe 414 PID 7432 set thread context of 4636 7432 svchost.exe 421 PID 4636 set thread context of 5200 4636 RegSvcs.exe 422 PID 8708 set thread context of 3476 8708 svchost.exe 471 PID 3476 set thread context of 7768 3476 RegSvcs.exe 472 PID 8340 set thread context of 6496 8340 svchost.exe 477 PID 6496 set thread context of 8696 6496 RegSvcs.exe 478 PID 8848 set thread context of 5452 8848 svchost.exe 484 PID 5452 set thread context of 7696 5452 RegSvcs.exe 485 PID 6268 set thread context of 3828 6268 svchost.exe 488 PID 3828 set thread context of 8280 3828 RegSvcs.exe 489 PID 7932 set thread context of 1504 7932 svchost.exe 492 PID 1504 set thread context of 3968 1504 RegSvcs.exe 493 PID 3144 set thread context of 6520 3144 svchost.exe 496 PID 6520 set thread context of 5720 6520 RegSvcs.exe 497 PID 1520 set thread context of 7364 1520 svchost.exe 500 PID 7364 set thread context of 5192 7364 RegSvcs.exe 501 PID 3472 set thread context of 1864 3472 svchost.exe 504 PID 1864 set thread context of 8160 1864 RegSvcs.exe 505 -
Drops file in Program Files directory 64 IoCs
Processes:
instup.exeBonziBuddy432.exeAvEmUpdate.exeengsup.exedescription ioc Process File opened for modification C:\Program Files\Avast Software\Avast\setup\ais_gen_crt_x64-834.vpx instup.exe File created C:\Program Files\Avast Software\Avast\defs\24100204\asw9e926f2de460d266.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-lv.json instup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page16.jpg BonziBuddy432.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\asw2e0d7c2d879c5464.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\aswac895edfeef91fda.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\asw7bea627b73171a03.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\wa_3rd_party_host_64.exe.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\setup\vps_defs_common-15cc.vpx instup.exe File opened for modification C:\Program Files\Avast Software\Avast\Licenses\aswea3ad6bf7f0e00b1.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswffa4de1cf600471d.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\asweb0f310e4f13a674.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\event_routing.dll.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-convert-l1-1-0.dll.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\mainLayout.js.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\aswba56b079b8d59164.tmp instup.exe File created C:\Program Files\Avast Software\Avast\setup\part-prg_ais-180917f2.vpx instup.exe File created C:\Program Files\Avast Software\Avast\defs\24100204\aswa58fd360aba90a06.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\asw7319788876c09e38.tmp instup.exe File created C:\Program Files\Avast Software\Avast\setup\Inf\x64\asw0dbe389840fe953a.tmp instup.exe File created C:\Program Files\Avast Software\Avast\setup\Inf\x64\asw917b136498e0ebdb.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\exts.dll.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\fr.pak.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\mainVars.json instup.exe File created C:\Program Files\Avast Software\Avast\1033\avast.local_vc142.crt\asw2b857b6ba1c8dea8.tmp instup.exe File created C:\Program Files\Avast Software\Avast\Setup\12883655-fe2a-459c-b145-94575407d2c7.ini AvEmUpdate.exe File created C:\Program Files\Avast Software\Avast\defs\24100204\asw18ae61ef3aa07bf1.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\Licenses\asw342a92ae9224f3b2.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\db_elf.sig.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\nos.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswKbd.sys.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\libs.js instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\asw1e9314155174d767.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\BrandingData\licensing\asw9fe55b80e7b8bb8a.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\vi.pak instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\svelteInternal.js instup.exe File created C:\Program Files\Avast Software\Avast\defs\24100204\avast.local_vc142.crt\api-ms-win-core-handle-l1-1-0.dll engsup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Options\uninstall.bat BonziBuddy432.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\db_sp.dat.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\libwaheap.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\aswcea57e7233708bb0.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\aswf59976760ad3a049.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\locales\aswda087d983ab87177.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\aswidpm.dll.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\vaarclient.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\resources.pak instup.exe File created C:\Program Files\Avast Software\Avast\defs\24100204\asw215f8476f441afb9.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\db_xtn.map.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\Licenses\xxHash.txt instup.exe File created C:\Program Files\Avast Software\Avast\setup\Inf\x64\aswRvrt.sys instup.exe File opened for modification C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page12.jpg BonziBuddy432.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\db_ob2.dat.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-crt-private-l1-1-0.dll instup.exe File opened for modification C:\Program Files\Avast Software\Avast\gui_resources\default_av\locale-ca.json.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\aswa9ac5f21c79c4f73.tmp instup.exe File created C:\Program Files\Avast Software\Avast\gui_resources\default_av\aswda894fe0085ea80a.tmp instup.exe File created C:\Program Files\Avast Software\Avast\setup\aswde1ec075d34ffe0c.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll instup.exe File created C:\Program Files\Avast Software\Avast\Setup\13dabe41-61e1-4f1a-a6d4-803f3a50cb23.cab AvEmUpdate.exe File opened for modification C:\Program Files\Avast Software\Avast\Licenses\aswd666d4fd53c73488.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\avast.local_vc142.crt\asw76eaf928ca11d1ad.tmp instup.exe File opened for modification C:\Program Files\Avast Software\Avast\defs\24100204\db_as.dat.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\snxhk.dll.sum instup.exe File opened for modification C:\Program Files\Avast Software\Avast\x86\avast.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll instup.exe -
Drops file in Windows directory 58 IoCs
Processes:
MSAGENT.EXEtv_enua.exeBonziBuddy432.exeinstup.exedescription ioc Process File opened for modification C:\Windows\msagent\AgentMPx.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentAnm.dll MSAGENT.EXE File created C:\Windows\lhsp\tv\SETFEDF.tmp tv_enua.exe File created C:\Windows\lhsp\help\SETFEE0.tmp tv_enua.exe File opened for modification C:\Windows\fonts\SETFEE1.tmp tv_enua.exe File opened for modification C:\Windows\fonts\andmoipa.ttf tv_enua.exe File opened for modification C:\Windows\msagent\chars\Bonzi.acs BonziBuddy432.exe File opened for modification C:\Windows\msagent\AgentDPv.dll MSAGENT.EXE File created C:\Windows\help\SETF2F1.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF303.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF2E8.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF2F0.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF2D8.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2E9.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\SETF2F2.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF303.tmp MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\SETFECE.tmp tv_enua.exe File created C:\Windows\INF\SETFEE2.tmp tv_enua.exe File created C:\Windows\ELAMBKUP\aswea90f02c3a3397ca.tmp instup.exe File opened for modification C:\Windows\msagent\SETF2D8.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\mslwvtts.dll MSAGENT.EXE File opened for modification C:\Windows\help\SETF2F1.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2EA.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF2EB.tmp MSAGENT.EXE File opened for modification C:\Windows\help\Agt0409.hlp MSAGENT.EXE File opened for modification C:\Windows\lhsp\help\SETFEE0.tmp tv_enua.exe File opened for modification C:\Windows\msagent\AgentDp2.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2ED.tmp MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\tvenuax.dll tv_enua.exe File opened for modification C:\Windows\INF\tv_enua.inf tv_enua.exe File created C:\Windows\msagent\SETF2EE.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\intl\Agt0409.dll MSAGENT.EXE File opened for modification C:\Windows\INF\SETF2EF.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2F0.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSvr.exe MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentSR.dll MSAGENT.EXE File opened for modification C:\Windows\INF\agtinst.inf MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\SETFEDF.tmp tv_enua.exe File opened for modification C:\Windows\INF\SETFEE2.tmp tv_enua.exe File opened for modification C:\Windows\msagent\chars\Peedy.acs BonziBuddy432.exe File opened for modification C:\Windows\msagent\SETF2E8.tmp MSAGENT.EXE File opened for modification C:\Windows\lhsp\help\tv_enua.hlp tv_enua.exe File created C:\Windows\fonts\SETFEE1.tmp tv_enua.exe File opened for modification C:\Windows\ELAMBKUP\aswea90f02c3a3397ca.tmp instup.exe File created C:\Windows\lhsp\tv\SETFECE.tmp tv_enua.exe File created C:\Windows\msagent\SETF2EA.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2EC.tmp MSAGENT.EXE File opened for modification C:\Windows\lhsp\tv\tv_enua.dll tv_enua.exe File created C:\Windows\msagent\SETF2ED.tmp MSAGENT.EXE File created C:\Windows\msagent\intl\SETF2F2.tmp MSAGENT.EXE File created C:\Windows\msagent\SETF2EC.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2EE.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentPsh.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\AgentCtl.dll MSAGENT.EXE File opened for modification C:\Windows\msagent\SETF2EB.tmp MSAGENT.EXE File opened for modification C:\Windows\msagent\AgtCtl15.tlb MSAGENT.EXE File created C:\Windows\msagent\SETF2E9.tmp MSAGENT.EXE File created C:\Windows\INF\SETF2EF.tmp MSAGENT.EXE -
Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs
When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.
Processes:
msedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe:Zone.Identifier msedge.exe -
Embeds OpenSSL 6 IoCs
Embeds OpenSSL, may be used to circumvent TLS interception.
Processes:
resource yara_rule behavioral1/files/0x0003000000025e51-509.dat embeds_openssl behavioral1/files/0x000100000002abb7-1135.dat embeds_openssl behavioral1/files/0x000100000002abda-1240.dat embeds_openssl behavioral1/files/0x000100000002abb3-2068.dat embeds_openssl behavioral1/files/0x000100000002ad6b-4163.dat embeds_openssl behavioral1/files/0x000100000002abaa-4155.dat embeds_openssl -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
Processes:
netsh.exedescription ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 6780 2408 WerFault.exe 246 -
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
BonziBDY_4.EXEattrib.exewinupdate.exeRegSvcs.exeRegSvcs.execvtres.execvtres.exeschtasks.execvtres.exevbc.exegrpconv.exevbc.execvtres.exeIEXPLORE.EXEaswOfferTool.exeregsvr32.execvtres.exevbc.exeRegSvcs.execvtres.execvtres.exevbc.exeBonziBDY_35.EXEcvtres.execvtres.execvtres.exeSpySheriff.exevbc.exeaswOfferTool.exeattrib.execvtres.exevbc.execvtres.exevbc.exereg.exeNetWire.execvtres.exevbc.exevbc.execvtres.exevbc.execmd.execvtres.exevbc.exevbc.exeRegSvcs.exeRegSvcs.exeregsvr32.exenotepad.exeattrib.exeattrib.exevbc.exeNJRat.execvtres.exeRegSvcs.exeAdwereCleaner.execvtres.exeAgentSvr.execmd.execvtres.execvtres.exevbc.execvtres.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BonziBDY_4.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language grpconv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IEXPLORE.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BonziBDY_35.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SpySheriff.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aswOfferTool.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NetWire.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language regsvr32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NJRat.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AdwereCleaner.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AgentSvr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cvtres.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
instup.exeAvastUI.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 instup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom instup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags instup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 instup.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags instup.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 AvastUI.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom AvastUI.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 AvastUI.exe -
Checks processor information in registry 2 TTPs 64 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
SetupInf.exeSetupInf.exeSetupInf.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeAvEmUpdate.exeRegSvr.exeAvastUI.exeBlackkomet.exeAvastNM.exeSetupInf.exeengsup.exeAvastUI.exewinupdate.exeSetupInf.exewinupdate.exeAvEmUpdate.exeAvastUI.exeRegSvr.exeSetupInf.exewinupdate.exewinupdate.exeengsup.exewsc_proxy.exedescription ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature avast_free_antivirus_setup_online_x64.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz RegSvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Blackkomet.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SetupInf.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 engsup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature engsup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvEmUpdate.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 RegSvr.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvEmUpdate.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvEmUpdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RegSvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastNM.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature SetupInf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvEmUpdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SetupInf.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 engsup.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 wsc_proxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wsc_proxy.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision instup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SetupInf.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SetupInf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision RegSvr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision engsup.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastUI.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastUI.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 AvastUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AvastUI.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Blackkomet.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString instup.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
Processes:
msedge.exeinstup.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\Bios instup.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosReleaseDate instup.exe -
Processes:
iexplore.exeIEXPLORE.EXERegSvr.exeRegSvr.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{AE67E1EF-80EB-11EF-A2EF-4233BF090FB9} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "434658496" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "8" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateLowDateTime = "2338517073" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager\FirstCheckForUpdateHighDateTime = "31134985" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\HomepagesUpgradeVersion = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\SearchScopesUpgradeVersion = "1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\Revision = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\StaleCompatCache = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "13" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\VersionManager iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80} RegSvr.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPMigrationVer = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "268435456" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.22000.1\"hypervisor=\"No Hypervisor (No SLAT)\"" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation RegSvr.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\VendorId = "4318" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListDomainAttributeSet = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionHigh = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionLow = "395196024" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\SoftwareFallback = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Recovery iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\SearchBandMigrationVersion = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\DisableFirstRunCustomize = "1" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\OperationalData = "9" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListXMLVersionHigh = "268435456" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\DeviceId = "140" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\IECompatVersionLow = "395196024" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation RegSvr.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{3C5422B3-D1E2-449E-A736-809C934C2F80} RegSvr.exe Set value (int) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\GPU\SubSysId = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe -
Modifies registry class 64 IoCs
Processes:
BonziBDY_4.EXEBonziBuddy432.exeregsvr32.exeAgentSvr.exeBonziBDY_35.EXEinstup.exeinstup.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F4900F67-055F-11D4-8F9B-00104BA312D6}\ProgID\ = "BonziBUDDY.clsBBPlayer" BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{22EB59AE-1CB8-4153-9DFC-B5CE048357CF}\VERSION\ = "1.4" BonziBDY_4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{972DE6C3-8B09-11D2-B652-A1FD6CC34260}\TypeLib BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FDD-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\MiscStatus\1\ = "148628" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DED86423-10D4-4CE1-8C84-9C9EC1B43364}\ProgID BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5BE8BD2-7DE6-11D0-91FE-00C04FD701A5}\ProgID\ = "Agent.Control.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BE3-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6D0ECB23-9968-11D0-AC6E-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}" AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\Version\ = "1.0" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{248DD890-BB45-11CF-9ABC-0080C7E7B78D}\1.0\0\win32\ = "C:\\Program Files (x86)\\BonziBuddy432\\MSWINSCK.OCX" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel.3\CLSID\ = "{065E6FDC-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FE6-1BF9-11D2-BAE8-00104B9E0792}\ = "SSRibbon Control 3.0" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveTabs.SSTabPanel.2\CLSID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F4043742-AC8D-4F86-88E9-F3FD3369DD8C}\TypeLib\Version = "1.1" BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\setup\\Inf\\aswHwid.inf" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D40-2CDD-11D3-9DD0-D3CD4078982A}\ = "ISkinButton" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{29D9184E-BF09-4F13-B356-22841635C733}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\BonziBuddy432" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{065E6FDC-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{0DE86A57-2BAA-11CF-A229-00AA003D7352} BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\ = "SSTabPanel Control" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Checking install conditions" instup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_UpdateSetup_Syncer = "62" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: aswPropertyAv.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F055-858B-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8DB2224E-D2FA-4B2E-8402-085EA7CC826B}\ProxyStubClsid BonziBDY_4.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{159C2806-4A71-45B4-8D4E-74C181CD6842}\ProxyStubClsid BonziBDY_4.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\aswWebRepIE.dll" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EE11629C-36DF-11D3-9DD0-89D6DBBBA800}\Insertable BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{66833FEB-8583-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BDD1F04E-858B-11D1-B16A-00C0F0283628}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveTabs.SSTabPanel\CurVer BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BDF-7DE6-11D0-91FE-00C04FD701A5}\ = "IAgentCtlPropertySheet" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\TypeLib AgentSvr.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: Sf2.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: event_manager_ga.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{065E6FE5-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\ = "{065E6FD1-1BF9-11D2-BAE8-00104B9E0792}" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8B77181C-D3EF-11D1-8500-00C04FA34A14}\ = "IAgentCtlAnimationNames" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\ = "{F5BE8BC2-7DE6-11D0-91FE-00C04FD701A5}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2C247F24-8591-11D1-B16A-00C0F0283628}\ = "IImages" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{248DD896-BB45-11CF-9ABC-0080C7E7B78D}\VersionIndependentProgID BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{916694A8-8AD6-11D2-B6FD-0060976C699F}\ = "RegiCon" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: vcruntime140_threads.dll" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: ja.pak" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{53FA8D44-2CDD-11D3-9DD0-D3CD4078982A}\InprocServer32\ = "C:\\PROGRA~2\\BONZIB~1\\ACTIVE~1.OCX" BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinPopup\CurVer\ = "ActiveSkin.SkinPopup.1" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\Programmable BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C74190B8-8589-11D1-B16A-00C0F0283628}\TypeLib BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{916694A8-8AD6-11D2-B6FD-0060976C699F}\TypeLib\ = "{6B1BE80A-567F-11D1-B652-0060976C699F}" BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\BonziBUDDY.CPeriod\Clsid BonziBDY_35.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: browserExtensions.js" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: secureLine.js" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Deleting file: C:\\Program Files\\Avast Software\\Avast\\ashWebSv.dll" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{37DEB787-2D9B-11D3-9DD0-C423E6542E10}\ProxyStubClsid32 BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A1-8586-11D1-B16A-00C0F0283628} BonziBuddy432.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{822DB1C0-8879-11D1-9EC6-00C04FD7081F} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F5BE8BF0-7DE6-11D0-91FE-00C04FD701A5} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{28E4193C-F276-4568-BCDC-DD15D88FADCC}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}" BonziBDY_4.EXE Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Installation_Syncer = "69" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: proximanova-regular.otf" instup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AvastPersistentStorage\InstupProgress_Description = "Extracting file: mainVars.json" instup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{48E59293-9880-11CF-9754-00AA00C00908}\TypeLib BonziBuddy432.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1EF6BEC0-E669-11CD-836C-0000C0C14E92}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}" BonziBuddy432.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\CLASSES\.LSF BonziBDY_35.EXE -
Modifies registry key 1 TTPs 2 IoCs
-
Processes:
6AdwCleaner.exedescription ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA\Blob = 0300000001000000140000008ad5c9987e6f190bd6f5416e2de44ccd641d8cda140000000100000014000000daed6474149c143cabdd99a9bd5b284d8b3cc9d8040000000100000010000000ff5fbc4290fa389e798467ebd7ae940b0f0000000100000014000000c45627b5584bf62327df60d6185744a2d2f2bcbf190000000100000010000000e843ac3b52ec8c297fa948c9b1fb28195c00000001000000040000000008000018000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c4b0000000100000044000000350034003500370041003800430045003400420032004100370034003900390046003800320039003900410030003100330042003600450031004300370043005f000000200000000100000088040000308204843082036ca0030201020210421af2940984191f520a4bc62426a74b300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3035303630373038303931305a170d3230303533303130343833385a308195310b3009060355040613025553310b3009060355040813025554311730150603550407130e53616c74204c616b652043697479311e301c060355040a131554686520555345525452555354204e6574776f726b3121301f060355040b1318687474703a2f2f7777772e7573657274727573742e636f6d311d301b0603550403131455544e2d5553455246697273742d4f626a65637430820122300d06092a864886f70d01010105000382010f003082010a0282010100ceaa813fa3a36178aa31005595119e270f1f1cdf3a9b826830c04a611df12f0efabe79f7a523ef55519684cddbe3b96e3e31d80a2067c7f4d9bf94eb47043e02ce2aa25d870409f6309d188a97b2aa1cfc41d2a136cbfb3d91bae7d97035fae4e790c39ba39bd33cf5129977b1b709e068e61cb8f39463886a6afe0b76c9bef422e467b9ab1a5e77c18507dd0d6cbfee06c7776a419ea70fd7fbee9417b7fc85bea4abc41c31ddd7b6d1e4f0efdf168fb25293d7a1d489a1072ebfe10112421e1ae1d89534db647928ffba2e11c2e5e85b9248fb470bc26cdaad328341f3a5e54170fd65906dfafa51c4f9bd962b19042cd36da7dcf07f6f8365e26aab8786750203010001a381f43081f1301f0603551d23041830168014adbd987a34b426f7fac42654ef03bde024cb541a301d0603551d0e04160414daed6474149c143cabdd99a9bd5b284d8b3cc9d8300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030440603551d1f043d303b3039a037a0358633687474703a2f2f63726c2e7573657274727573742e636f6d2f416464547275737445787465726e616c4341526f6f742e63726c303506082b0601050507010104293027302506082b060105050730018619687474703a2f2f6f6373702e7573657274727573742e636f6d300d06092a864886f70d010105050003820101004d422fa6c18aeb07809058468cf81939662a3c5a2c6dcfd4d987558d790b12887b408fd5c7f84b8d551663adb757dc3b2bbdd3c14f1e03874b449be3e2404526f326492b6a84f1547ad442dafcd36abb667eca9eeae9bbdc07c7c3924e833c81499f92d53209ea492ea111719a36d2c54e68b6cb0e1b2516af6cde5d76d81f72b193268617db18deaf45e9dffb98af1418eda45ef6899445f055044addff27dd064a40f6b4bcf1e40f9902bbfd5d0e2e28c1be3b5f1a3f971084bc163ed8a39c631d66cb5c5fda3ef30f0a093522dbdbc03f00f9e60d5d67d1fda01e032bd940f7becc87665480a6a3b8f51962d5d226b19826ee9acb44a7455a8195151af551 6AdwCleaner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868 6AdwCleaner.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 0f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00b00000001000000260000005300650063007400690067006f00200028004100640064005400720075007300740029000000620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a1d000000010000001000000006f9583c00a763c23fb9e065a3366d557e0000000100000008000000000063f58926d70168000000010000000800000000409120d035d90103000000010000001400000002faf3e291435468607857694df5e45b6885186820000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 6AdwCleaner.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\02FAF3E291435468607857694DF5E45B68851868\Blob = 19000000010000001000000045ed9bbc5e43d3b9ecd63c060db78e5c03000000010000001400000002faf3e291435468607857694df5e45b6885186868000000010000000800000000409120d035d9017e0000000100000008000000000063f58926d7011d000000010000001000000006f9583c00a763c23fb9e065a3366d55140000000100000014000000adbd987a34b426f7fac42654ef03bde024cb541a620000000100000020000000687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff20b00000001000000260000005300650063007400690067006f0020002800410064006400540072007500730074002900000053000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000001400000009b9105c5bba24343ca7f341c624e183f6ee7c1b20000000010000003a040000308204363082031ea003020102020101300d06092a864886f70d0101050500306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74301e170d3030303533303130343833385a170d3230303533303130343833385a306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100b7f71a33e6f200042d39e04e5bed1fbc6c0fcdb5fa23b6cede9b113397a4294c7d939fbd4abc93ed031ae38fcfe56d505ad69729945a80b0497adb2e95fdb8cabf37382d1e3e9141ad7056c7f04f3fe8329e74cac89054e9c65f0f789d9a403c0eac61aa5e148f9e87a16a50dcd79a4eaf05b3a671949c71b350600ac7139d38078602a8e9a869261890ab4cb04f23ab3a4f84d8dfce9fe1696fbbd742d76b44e4c7adee6d415f725a710837b37965a459a09437f7002f0dc29272dad03872db14a845c45d2a7db7b4d6c4eeaccd1344b7c92bdd430025fa61b9696a582311b7a7338f567559f5cd29d746b70a2b65b6d3426f15b2b87bfbefe95d53d5345a270203010001a381dc3081d9301d0603551d0e04160414adbd987a34b426f7fac42654ef03bde024cb541a300b0603551d0f040403020106300f0603551d130101ff040530030101ff3081990603551d2304819130818e8014adbd987a34b426f7fac42654ef03bde024cb541aa173a471306f310b300906035504061302534531143012060355040a130b416464547275737420414231263024060355040b131d41646454727573742045787465726e616c20545450204e6574776f726b312230200603550403131941646454727573742045787465726e616c20434120526f6f74820101300d06092a864886f70d01010505000382010100b09be08525c2d623e20f9606929d41989cd9847981d91e5b14072336658fb0d877bbac416c47608351b0f9323de7fcf62613c78016a5bf5afc87cf787989219ae24c070a8635bcf2de51c4d296b7dc7e4eee70fd1c39eb0c0251142d8ebd16e0c1df4675e724adecf442b48593701067ba9d06354a18d32b7acc5142a17a63d1e6bba1c52bc236be130de6bd637e797ba7090d40ab6add8f8ac3f6f68c1a420551d445f59fa76221681520433c99e77cbd24d8a9911773883f561b313818b4710f9acdc80e9e8e2e1be18c9883cb1f31f1444cc604734976600fc7f8bd17806b2ee9cc4c0e5a9a790f200a2ed59e63261e559294d882175a7bd0bcc78f4e8604 6AdwCleaner.exe Key created \REGISTRY\USER\S-1-5-21-2227988167-2813779459-4240799794-1000\Software\Microsoft\SystemCertificates\CA\Certificates\8AD5C9987E6F190BD6F5416E2DE44CCD641D8CDA 6AdwCleaner.exe -
NTFS ADS 9 IoCs
Processes:
msedge.exeRegSvcs.exeVanToM-Rat.batRegSvcs.exemsedge.exemsedge.exemsedge.exemsedge.exemsedge.exedescription ioc Process File opened for modification C:\Users\Admin\Downloads\hosts-3.14.115.zip:Zone.Identifier msedge.exe File created C:\svchost\svchost.exe\:Zone.Identifier:$DATA RegSvcs.exe File created C:\Users\Admin\AppData\Roaming\VanToM Folder\Server.exe\:Zone.Identifier:$DATA VanToM-Rat.bat File created C:\Users\Admin\AppData\Roaming\svchost.exe\:Zone.Identifier:$DATA RegSvcs.exe File opened for modification C:\Users\Admin\Downloads\Unconfirmed 194518.crdownload:SmartScreen msedge.exe File opened for modification C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Reverse-Engineering-main.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\The-MALWARE-Repo-master.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Bon.zip:Zone.Identifier msedge.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
msedge.exemsedge.exeidentity_helper.exemsedge.exemsedge.exeavast_free_antivirus_setup_online_x64.exeinstup.exemsedge.exeavDump.exemsedge.exemsedge.exemsedge.exeAvastUI.exeAvastUI.exemsedge.exeAvastUI.exeNJRat.exepid Process 2576 msedge.exe 2576 msedge.exe 660 msedge.exe 660 msedge.exe 5084 identity_helper.exe 5084 identity_helper.exe 3292 msedge.exe 3292 msedge.exe 5420 msedge.exe 5420 msedge.exe 5576 avast_free_antivirus_setup_online_x64.exe 5576 avast_free_antivirus_setup_online_x64.exe 5576 avast_free_antivirus_setup_online_x64.exe 5576 avast_free_antivirus_setup_online_x64.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 6112 msedge.exe 6112 msedge.exe 6112 msedge.exe 6112 msedge.exe 1060 avDump.exe 1060 avDump.exe 3552 instup.exe 3552 instup.exe 2552 msedge.exe 2552 msedge.exe 8112 msedge.exe 8112 msedge.exe 6824 msedge.exe 6824 msedge.exe 6676 AvastUI.exe 6676 AvastUI.exe 5392 AvastUI.exe 5392 AvastUI.exe 6572 msedge.exe 6572 msedge.exe 6360 AvastUI.exe 6360 AvastUI.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe 2552 NJRat.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
Processes:
AvastUI.exeUserdata.exeNJRat.exeServer.exepid Process 6360 AvastUI.exe 6944 Userdata.exe 2552 NJRat.exe 4908 Server.exe -
Suspicious behavior: LoadsDriver 13 IoCs
Processes:
pid Process 688 688 688 688 688 688 688 688 688 688 688 688 688 -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 64 IoCs
Processes:
msedge.exepid Process 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
avast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exedescription pid Process Token: 32 5576 avast_free_antivirus_setup_online_x64.exe Token: SeDebugPrivilege 5576 avast_free_antivirus_setup_online_x64.exe Token: 32 3804 instup.exe Token: SeDebugPrivilege 3804 instup.exe Token: SeDebugPrivilege 3552 instup.exe Token: 32 3552 instup.exe Token: SeDebugPrivilege 6132 aswOfferTool.exe Token: SeImpersonatePrivilege 6132 aswOfferTool.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: 35 3552 instup.exe Token: SeRestorePrivilege 3552 instup.exe Token: SeTakeOwnershipPrivilege 3552 instup.exe Token: SeRestorePrivilege 3552 instup.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
msedge.exeinstup.exeAvastUI.exepid Process 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 3552 instup.exe 3552 instup.exe 3552 instup.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
Processes:
msedge.exeinstup.exeAvastUI.exeAgentSvr.exepid Process 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 3552 instup.exe 3552 instup.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 6360 AvastUI.exe 660 msedge.exe 660 msedge.exe 3632 AgentSvr.exe 3632 AgentSvr.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe 660 msedge.exe -
Suspicious use of SetWindowsHookEx 46 IoCs
Processes:
avast_free_antivirus_setup_online.exeavast_free_antivirus_setup_online_x64.exeinstup.exeinstup.exeaswOfferTool.exeaswOfferTool.exeaswOfferTool.exesbr.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeSetupInf.exeAvEmUpdate.exeAvEmUpdate.exeRegSvr.exeRegSvr.exeAvastNM.exeSetupInf.exeoverseer.exeengsup.exeavDump.exeengsup.exeAvastUI.exeAvastUI.exeAvastUI.exeBonziBuddy432.exetv_enua.exeMSAGENT.EXEAgentSvr.exeBonziBDY_4.EXEUserdata.exeVanToM-Rat.batServer.exe6AdwCleaner.exeBonziBDY_35.EXEiexplore.exeIEXPLORE.EXEpid Process 1076 avast_free_antivirus_setup_online.exe 5576 avast_free_antivirus_setup_online_x64.exe 3804 instup.exe 3804 instup.exe 3552 instup.exe 3552 instup.exe 6032 aswOfferTool.exe 6072 aswOfferTool.exe 6132 aswOfferTool.exe 3552 instup.exe 1736 sbr.exe 4328 SetupInf.exe 808 SetupInf.exe 3316 SetupInf.exe 5460 SetupInf.exe 5188 SetupInf.exe 2956 AvEmUpdate.exe 876 AvEmUpdate.exe 6912 RegSvr.exe 1804 RegSvr.exe 6072 AvastNM.exe 5080 SetupInf.exe 4564 overseer.exe 6876 engsup.exe 1060 avDump.exe 4524 engsup.exe 6360 AvastUI.exe 6676 AvastUI.exe 5392 AvastUI.exe 7304 BonziBuddy432.exe 1272 tv_enua.exe 8372 MSAGENT.EXE 6316 AgentSvr.exe 5400 BonziBDY_4.EXE 5400 BonziBDY_4.EXE 6944 Userdata.exe 7704 VanToM-Rat.bat 4908 Server.exe 2152 6AdwCleaner.exe 2152 6AdwCleaner.exe 1112 BonziBDY_35.EXE 1112 BonziBDY_35.EXE 3480 iexplore.exe 3480 iexplore.exe 6100 IEXPLORE.EXE 6100 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
msedge.exedescription pid Process procid_target PID 660 wrote to memory of 4032 660 msedge.exe 79 PID 660 wrote to memory of 4032 660 msedge.exe 79 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2604 660 msedge.exe 80 PID 660 wrote to memory of 2576 660 msedge.exe 81 PID 660 wrote to memory of 2576 660 msedge.exe 81 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 PID 660 wrote to memory of 3096 660 msedge.exe 82 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 10 IoCs
Processes:
attrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exeattrib.exepid Process 4304 attrib.exe 2984 attrib.exe 5968 attrib.exe 7748 attrib.exe 9200 attrib.exe 6512 attrib.exe 5248 attrib.exe 5688 attrib.exe 4920 attrib.exe 8544 attrib.exe
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://gta-6.en.softonic.com/1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:660 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa229f3cb8,0x7ffa229f3cc8,0x7ffa229f3cd82⤵PID:4032
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1980 /prefetch:22⤵PID:2604
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:2576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:82⤵PID:3096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:4196
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:12⤵PID:1372
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:12⤵PID:2920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:12⤵PID:4772
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:12⤵PID:4628
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:1484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:12⤵PID:1980
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:5072
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:12⤵PID:1084
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:12⤵PID:4124
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:12⤵PID:3636
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:12⤵PID:5012
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6188 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:12⤵PID:3068
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:12⤵PID:1008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6812 /prefetch:12⤵PID:440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7196 /prefetch:12⤵PID:252
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7192 /prefetch:12⤵PID:4828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2620 /prefetch:12⤵PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7672 /prefetch:12⤵PID:5220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7680 /prefetch:12⤵PID:5292
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3540 /prefetch:12⤵PID:5704
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7696 /prefetch:12⤵PID:6036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:12⤵PID:564
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6332 /prefetch:82⤵PID:1064
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5944 /prefetch:82⤵
- Subvert Trust Controls: Mark-of-the-Web Bypass
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:5420
-
-
C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"C:\Users\Admin\Downloads\avast_free_antivirus_setup_online.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1076 -
C:\Windows\Temp\asw.f3c3439af99a21d7\avast_free_antivirus_setup_online_x64.exe"C:\Windows\Temp\asw.f3c3439af99a21d7\avast_free_antivirus_setup_online_x64.exe" /cookie:mmm_sft_dlp_000_119_h:dlid_FAV-PPC /ga_clientid:f06fc232-ac29-466a-89a0-c1b5ce828888 /edat_dir:C:\Windows\Temp\asw.f3c3439af99a21d7 /geo:GB3⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5576 -
C:\Windows\Temp\asw.1d282069929687aa\instup.exe"C:\Windows\Temp\asw.1d282069929687aa\instup.exe" /sfx:lite /sfxstorage:C:\Windows\Temp\asw.1d282069929687aa /edition:1 /prod:ais /stub_context:218670b9-85ba-4e93-8255-8743b15f0027:11058160 /guid:02a08a1e-983c-48bf-9485-ba4ac7467f31 /ga_clientid:f06fc232-ac29-466a-89a0-c1b5ce828888 /no_delayed_installation /cookie:mmm_sft_dlp_000_119_h:dlid_FAV-PPC /ga_clientid:f06fc232-ac29-466a-89a0-c1b5ce828888 /edat_dir:C:\Windows\Temp\asw.f3c3439af99a21d7 /geo:GB4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3804 -
C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\instup.exe"C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\instup.exe" /sfx /sfxstorage:C:\Windows\Temp\asw.1d282069929687aa /edition:1 /prod:ais /stub_context:218670b9-85ba-4e93-8255-8743b15f0027:11058160 /guid:02a08a1e-983c-48bf-9485-ba4ac7467f31 /ga_clientid:f06fc232-ac29-466a-89a0-c1b5ce828888 /no_delayed_installation /cookie:mmm_sft_dlp_000_119_h:dlid_FAV-PPC /edat_dir:C:\Windows\Temp\asw.f3c3439af99a21d7 /geo:GB /online_installer5⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Executes dropped EXE
- Impair Defenses: Safe Mode Boot
- Loads dropped DLL
- Windows security modification
- Adds Run key to start application
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3552 -
C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe"C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe" -checkGToolbar -elevated6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6032
-
-
C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe"C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe" /check_secure_browser6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6072
-
-
C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe"C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\aswOfferTool.exe" -checkChromeReactivation -elevated -bc=AVFC6⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:6132 -
C:\Users\Public\Documents\aswOfferTool.exe"C:\Users\Public\Documents\aswOfferTool.exe" -checkChromeReactivation -bc=AVFC7⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5136
-
-
-
C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\sbr.exe"C:\Windows\Temp\asw.1d282069929687aa\New_180917f2\sbr.exe" 3552 "Avast Antivirus setup" "Avast Antivirus is being installed. Do not shut down your computer!"6⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1736
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRdr2.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4328
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswHwid.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:808
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswVmm.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:3316
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /uninstall /catalog:aswRvrt.cat6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5460
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /elaminst C:\Windows\system32\drivers\aswElam.sys6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5188
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer /reg6⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2956
-
-
C:\Program Files\Avast Software\Avast\AvEmUpdate.exe"C:\Program Files\Avast Software\Avast\AvEmUpdate.exe" /installer6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:876
-
-
C:\Program Files\Avast Software\Avast\x86\RegSvr.exe"C:\Program Files\Avast Software\Avast\x86\RegSvr.exe" "C:\Program Files\Avast Software\Avast\x86\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:6912
-
-
C:\Program Files\Avast Software\Avast\RegSvr.exe"C:\Program Files\Avast Software\Avast\RegSvr.exe" "C:\Program Files\Avast Software\Avast\aswAMSI.dll"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:1804
-
-
C:\Program Files\Avast Software\Avast\AvastNM.exe"C:\Program Files\Avast Software\Avast\AvastNM.exe" /install6⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6072
-
-
C:\Program Files\Avast Software\Avast\SetupInf.exe"C:\Program Files\Avast Software\Avast\SetupInf.exe" /catinstall:"C:\Program Files\Avast Software\Avast\setup\crts.cat" /basename:pkg_{af98c830-4f53-4176-a7b0-ec21fc603adc}.cat /crtid:D9D1E63123760F5EE0F69B6613E0933E9CBCAB116⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:5080
-
-
C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe"C:\Program Files\Common Files\Avast Software\Overseer\overseer.exe" /skip_uptime /skip_remediations6⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:4564
-
-
C:\Program Files\Avast Software\Avast\defs\24100204\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24100204\engsup.exe" /prepare_definitions_folder6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:6876
-
-
C:\Program Files\Avast Software\Avast\wsc_proxy.exe"C:\Program Files\Avast Software\Avast\wsc_proxy.exe" /svc /register /ppl_svc6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
PID:6848 -
C:\Program Files\Avast Software\Avast\avDump.exe"C:\Program Files\Avast Software\Avast\avDump.exe" --pid 6848 --exception_ptr 000000DE39AFEC00 --thread_id 2268 --dump_level 21 --dump_file "C:\ProgramData\Avast Software\Avast\log\unp311349651761428583i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 607⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1060
-
-
-
C:\Program Files\Avast Software\Avast\defs\24100204\engsup.exe"C:\Program Files\Avast Software\Avast\defs\24100204\engsup.exe" /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie /get_latest_trpar6⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:4524
-
-
-
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1720 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:6112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4628 /prefetch:12⤵PID:5868
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:12⤵PID:5472
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3848 /prefetch:12⤵PID:7008
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:12⤵PID:7368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:12⤵PID:7356
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7520 /prefetch:12⤵PID:7804
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6220 /prefetch:12⤵PID:7964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3864 /prefetch:12⤵PID:7972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵PID:9192
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7320 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:12⤵PID:7712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6184 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:8112
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:12⤵PID:544
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=216 /prefetch:12⤵PID:4000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:12⤵PID:6276
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:12⤵PID:8340
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6388 /prefetch:12⤵PID:8396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7316 /prefetch:12⤵PID:8476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=55 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7040 /prefetch:12⤵PID:2144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=56 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6264 /prefetch:12⤵PID:5476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=57 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2936 /prefetch:12⤵PID:5444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=58 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:12⤵PID:4288
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=59 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=60 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7152 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=61 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7332 /prefetch:12⤵PID:5960
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=62 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:12⤵PID:4368
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=63 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:12⤵PID:3268
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=64 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:12⤵PID:7500
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=65 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7424 /prefetch:12⤵PID:7532
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=66 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1932 /prefetch:12⤵PID:7416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=67 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7396 /prefetch:12⤵PID:2520
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=68 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7916 /prefetch:12⤵PID:5600
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=69 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7380 /prefetch:12⤵PID:1348
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=70 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8460 /prefetch:12⤵PID:1324
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=71 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8376 /prefetch:12⤵PID:6488
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=72 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8572 /prefetch:12⤵PID:7764
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=73 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7540 /prefetch:12⤵PID:5308
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=74 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8892 /prefetch:12⤵PID:9016
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=75 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9092 /prefetch:12⤵PID:8852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=76 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7784 /prefetch:12⤵PID:9096
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=77 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:12⤵PID:3108
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=78 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=9052 /prefetch:12⤵PID:8996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=79 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8664 /prefetch:12⤵PID:5156
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=80 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8764 /prefetch:12⤵PID:2216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=81 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7384 /prefetch:12⤵PID:1144
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=82 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8476 /prefetch:12⤵PID:3176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=83 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8864 /prefetch:12⤵PID:4440
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=84 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6948 /prefetch:12⤵PID:6632
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=85 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1060 /prefetch:12⤵PID:9128
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1780,16147785635730478615,4618407958794936642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=86 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=8964 /prefetch:12⤵PID:6724
-