59fb16a77892da4cc1cfd34c36dd1edde53f8e33b1e7033ec078571dcf49165a

Analysis

max time kernel
203s
max time network
316s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
09-11-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

win.reg
Size

192.3MB
MD5

85dfbda474020974f824e9a94967fa22
SHA1

babcd8cd4014995f3ac81784fe22539029324ada
SHA256

59fb16a77892da4cc1cfd34c36dd1edde53f8e33b1e7033ec078571dcf49165a
SHA512

793cb697af5c2245d179048c21c3b0c037796ba9dc037b8ee184939c077ebf06dc2390136f24c254b81c3bc6a91bfb93431400dec14be53691e13bc3daad3099
SSDEEP

49152:6TnkdSwskX+pXxuH4MuLyZGfUUlVEqcHSkHl:JdSwskX+pXxuH4MuLyZGfUUY

Score

10^/10

adware defense_evasion evasion persistence privilege_escalation stealer trojan

Malware Config

Signatures

Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebCheck = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\WebCheck = "{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad	regedit.exe

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe"	regedit.exe

Modifies Windows Defender notification settings 3 TTPs 2 IoCs

evasion trojan

Windows Service

T1543.003

Modify Registry

T1112

Disable or Modify Tools

T1562.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender Security Center\Notifications	regedit.exe

UAC bypass 3 TTPs 8 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "5"	regedit.exe

Windows security bypass 2 TTPs 10 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\IpAddresses	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\TemporaryPaths	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Extensions	regedit.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 64 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}\Locale = "*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\Locale = "*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}\ = "Browsing Enhancements"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9381D8F2-0288-11D0-9501-00AA00B911A5}\Locale = "*"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\Enabled = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\ = "Microsoft Windows Media Player 12.0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\IsInstalled = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}\IsInstalled = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}\ = "Address Book 7"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}\IsInstalled = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\Localized Name = "Microsoft Edge"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\ = "DirectDrawEx"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}\ComponentID = "Fontcore"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\ = "Microsoft Windows Script 5.6"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\IsInstalled = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\Version = "11,3672,22621,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}\ComponentID = "DirectDrawEx"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}\ComponentID = "DOTNETFRAMEWORKS"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE}\StubPath = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\100.0.1185.36\\Installer\\setup.exe\" --configure-user-settings --verbose-logging --system-level --msedge"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}\ComponentID = "HTMLHelp"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\IsInstalled = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48C478DA-C541-30C5-BB40-2249FE46DE6A}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\Version = "11,3672,22621,0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48C478DA-C541-30C5-BB40-2249FE46DE6A}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{7790769C-0471-11d2-AF11-00C04FA35D02}\Version = "10,0,22621,1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\Locale = "*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\Version = "5,0,00,0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\IsInstalled = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{630b1da0-b465-11d1-9948-00c04f98bbc9}\Locale = "*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}\ = "Internet Explorer Setup Tools"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{6fab99d0-bab8-11d1-994a-00c04f98bbc9}\Version = "4,9,9,2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\StubPath = "U"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{de5aed00-a4bf-11d1-9948-00c04f98bbc9}\Locale = "*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\ComponentID = "ADSI"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\ = "Themes Setup"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{4f645220-306d-11d2-995d-00c04f98bbc9}\ComponentID = "MSVBScript"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{44BBA855-CC51-11CF-AAFA-00AA00B6015F}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{C9E9A340-D1F1-11D0-821E-444553540600}\Version = "11,3672,22621,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48C478DA-C541-30C5-BB40-2249FE46DE6A}\Version = "4,0,30319,0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\IsInstalled = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}\ComponentID = "GenSetup"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{E92B03AB-B707-11d2-9CBD-0000F87A369E}\ComponentID = "ADSI"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{3af36230-a269-11d1-b5bf-0000f8051515}\ComponentID = "MobilePk"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{5fd399c0-a70a-11d1-9948-00c04f98bbc9}\Version = "11,3672,22621,0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\ = "Themes Setup"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{45ea75a0-a269-11d1-b5bf-0000f8051515}\ = "Internet Explorer Help"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{48C478DA-C541-30C5-BB40-2249FE46DE6A}\Version = "4,0,30319,0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,10011,16384"	regedit.exe

Event Triggered Execution: AppInit DLLs 1 TTPs
Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.
persistence privilege_escalation

AppInit DLLs
T1546.010

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ExtExport.exe\MitigationOptions = "256"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\DisableExceptionChainValidation = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\CFGOptions = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\MitigationOptions = "4294967296"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MRT.exe\CFGOptions = "1"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngentask.exe\MitigationOptions = "4294967296"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe\MitigationOptions = "4294967296"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\MitigationOptions = "256"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\MitigationOptions = "2097152"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintDialog.exe\MitigationOptions = "4294967296"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\DisableExceptionChainValidation = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsSense.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe\MitigationOptions = "256"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe\MitigationOptions = "2097152"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieinstal.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\CFGOptions = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PrintIsolationHost.exe\MitigationOptions = "2097152"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runtimebroker.exe\MitigationOptions = "4294967296"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe\MitigationOptions = "256"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ieUnatt.exe\MitigationOptions = "256"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe\AuditLevel = "8"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\spoolsv.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ielowutil.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mshta.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsSense.exe\MitigationOptions = "16777232"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ngen.exe\MitigationOptions = "4294967296"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\MitigationOptions = "2097152"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SystemSettings.exe\MitigationOptions = "4294967296"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\LSASS.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mscorsvw.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsMpEng.exe\CFGOptions = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PresentationHost.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\DisableUserModeCallbackFilter = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msfeedssync.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MsSense.exe\MitigationOptions = "16777232"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\splwow64.exe\MitigationOptions = "2097152"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\svchost.exe	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ie4uinit.exe	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MicrosoftEdgeUpdate.exe\DisableExceptionChainValidation = "0"	regedit.exe

Manipulates Digital Signatures 1 TTPs 64 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllOpenStoreProv\Ldap\FuncName = "LdapProvOpenStore"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetCaps\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPGetCaps"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPPutSignedDataMsg"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2012\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Initialization\{31D1ADC1-D329-11D1-8ED8-0080C76516C6}\$Function = "SoftpubInitialize"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CertDllCreateCertificateChainEngine\Config\Default\WeakMd5ThirdPartyFlags = "2291138560"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}\FuncName = "P7xSipRemoveSignedDataMsg"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\#2010\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{7801EBD0-CF4B-11D0-851F-0060979387EA}\$Function = "CertTrustCleanup"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{573E31F8-AABA-11D0-8CCB-00C04FC295EE}\$Function = "HTTPSCertificateTrust"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{573E31F8-DDBA-11D0-8CCB-00C04FC295EE}\$DLL = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}\$Function = "SoftpubCheckCert"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPRemoveSignedDataMsg"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.10.3.37!7\Name = "@%SystemRoot%\\System32\\ci.dll,-100"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\FuncName = "CryptSIPGetSignedDataMsg"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\Dll = "C:\\Windows\\System32\\cryptdlg.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{FC451C16-AC75-11D1-B4B8-00C04FB66EA0}\$Function = "GenericChainFinalProv"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{D1D04F0C-9ABA-430D-B0E4-D7E96ACCE66C}\Dll = "C:\\Windows\\System32\\AppxSip.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{000C10F1-0000-0000-C000-000000000046}\Dll = "C:\\Windows\\System32\\MSISIP.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllFormatObject\1.3.6.1.5.5.7.3.4\Dll = "C:\\Windows\\System32\\cryptdlg.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\FuncName = "VerifyIndirectData"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\1.3.6.1.4.1.311.10.3.3\CallbackFreeFunction = "SoftpubFreeDefUsageCallData"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AABA-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{603BCC1F-4B59-4E08-B724-D2C6297EF351}\FuncName = "PsPutSignature"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Usages\2.16.840.1.113730.4.1\DefaultId = "{573E31F8-AABA-11D0-8CCB-00C04FC295EE}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.26\FuncName = "WVTAsn1SpcMinimalCriteriaInfoDecode"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2130\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}\FuncName = "P7SipCreateIndirectData"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}\Dll = "C:\\Windows\\System32\\AppxSip.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}\Dll = "C:\\Windows\\System32\\EsdSip.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{DE351A43-8E59-11D0-8C47-00C04FC295EE}\FuncName = "CryptSIPGetSealedDigest"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}\FuncName = "EsdSipIsMyFileType"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "SoftpubCheckCert"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2000\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Certificate\{A7F4C378-21BE-494e-BA0F-BB12C5D208C5}\$Function = "WintrustCertificateTrust"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1A610570-38CE-11D4-A2A3-00104BD35090}\Dll = "C:\\Windows\\System32\\wshext.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\#2007\FuncName = "WVTAsn1SpcSpOpusInfoEncode"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindLocalizedName\LocalizedNames\OemEsim = "@%systemroot%\\system32\\wsdapi.dll,-201"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}\FuncName = "AppxSipIsFileSupportedName"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Cleanup\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\$Function = "DriverCleanupPolicy"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{D41E4F1F-A407-11D1-8BC9-00C04FA30A41}\$DLL = "C:\\Windows\\System32\\ieframe.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\Signature\{64B9D180-8DA2-11CF-8736-00AA00A485EB}\$Function = "SoftpubLoadSignature"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSealedDigest\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{CF78C6DE-64A2-4799-B506-89ADFF5D16D6}\FuncName = "EappxSipIsFileSupportedName"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{1629F04E-2799-4DB5-8FE5-ACE10F17EBAB}\Dll = "C:\\Windows\\System32\\wshext.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{0F5F58B3-AADE-4B9A-A434-95742D92ECEB}\FuncName = "AppxBundleSipVerifyIndirectData"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB8-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\Providers\Trust\CertCheck\{C6B2E8D0-E005-11CF-A134-00C04FD7BF43}\$DLL = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.4.4\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{9BA61D3F-E73A-11D0-8CD2-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.16.1.1\FuncName = "EncodeAttrSequence"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllIsMyFileType2\{5598CFF1-68DB-4340-B57F-1CACF88C9A51}\Dll = "C:\\Windows\\System32\\AppxSip.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{C689AAB9-8E78-11D0-8C47-00C04FC295EE}\Dll = "WINTRUST.DLL"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllDecodeObject\1.3.6.1.4.1.311.2.1.28\FuncName = "WVTAsn1SpcLinkDecode"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 1\CryptDllEncodeObject\1.3.6.1.4.1.311.2.1.28\FuncName = "WVTAsn1SpcLinkEncode"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{0AC5DF4B-CE07-4DE2-B76E-23C839A09FD1}\Dll = "C:\\Windows\\System32\\AppxSip.dll"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{9F3053C5-439D-4BF7-8A77-04F0450A1D9F}\FuncName = "EsdSipDelSignature"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{06C9E010-38CE-11D4-A2A3-00104BD35090}\FuncName = "VerifyIndirectData"	regedit.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 560052005400550041004c0020002d00200031000000480079007000650072002d005600200055004500460049002000520065006c0065006100730065002000760034002e00310000004d006900630072006f0073006f006600740020002d00200031003000300030003300320000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 560052005400550041004c0020002d00200031000000480079007000650072002d005600200055004500460049002000520065006c0065006100730065002000760034002e00310000004d006900630072006f0073006f006600740020002d00200031003000300030003300320000000000	regedit.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 64 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\DefaultIcon\ = "%1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ShellEx\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{1531d583-8375-4d3f-b5fb-d23bbd169f22}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\EditFlags = 38070000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runas\HasLUAShield	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\CLSID	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6005"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\EditFlags = 30000000	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser\Extended	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\EditFlags = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\NeverShowExt	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\EditFlags = "0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\IconHandler\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler\ = "{00021401-0000-0000-C000-000000000046}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\PropertySheetHandlers	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\Compatibility	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets\selection = "1797"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command\ = "%SystemRoot%\\System32\\NOTEPAD.EXE %1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\ContextMenuHandlers\PintoStartScreen\ = "{470C0EBD-5D73-4d58-9CED-E91E22E23282}"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\DropHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\tabsets	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command\ = "%SystemRoot%\\System32\\NOTEPAD.EXE /p %1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\DefaultIcon\ = "%SystemRoot%\\System32\\shell32.dll,2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"%1\" %*"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\FriendlyTypeName = "@%SystemRoot%\\System32\\shell32.dll,-8464"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shellex\PropertySheetHandlers	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\EditFlags = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"%1\" %*"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\Extended	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\runasuser	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\EditFlags = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shellex\PropertySheetHandlers\Console	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shellex\IconHandler	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shellex	regedit.exe

Hijack Execution Flow: Executable Installer File Permissions Weakness 1 TTPs 2 IoCs

Possible Turn off User Account Control's privilege elevation for standard users.

defense_evasion persistence privilege_escalation

Executable Installer File Permissions Weakness

T1574.005

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0"	regedit.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\ = "IEToEdge BHO"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C}\NoExplorer = "1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects	regedit.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 2 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	regedit.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\16\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\20\~MHz = "4392"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\21\Component Information = 00000000000000001500000000001500	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\13\Update Revision = ffffffff00000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet = "943406591"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\22\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\13\Component Information = 00000000000000000d00000000000d00	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\17\~MHz = "4392"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\20\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\17\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\8\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\11\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\12\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Component Information = 00000000000000000400000000000400	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\21	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\11\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz = "4392"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\10\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\19\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\20\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\10\FeatureSet = "943406591"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\15\Component Information = 00000000000000000f00000000000f00	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\12\Update Revision = ffffffff00000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\23\Component Information = 00000000000000001700000000001700	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Component Information = 00000000000000000300000000000300	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\22\VendorIdentifier = "AuthenticAMD"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\15\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18\Component Information = 00000000000000001200000000001200	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\19\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\8\VendorIdentifier = "AuthenticAMD"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\15	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\20\Update Revision = ffffffff00000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\10\Component Information = 00000000000000000a00000000000a00	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\18\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\15\Update Revision = ffffffff00000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\8\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\9\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\9\FeatureSet = "943406591"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\11\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\21\FeatureSet = "943406591"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\22\FeatureSet = "943406591"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\23\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\16\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\17\Component Information = 00000000000000001100000000001100	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\17\~MHz = "4392"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\14\VendorIdentifier = "AuthenticAMD"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString = "AMD Ryzen 9 7900X3D 12-Core Processor "	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\23\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\20\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\10	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\17\Component Information = 00000000000000001100000000001100	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data = 01000000000000000000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\11	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\22\Component Information = 00000000000000001600000000001600	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data = ffffffffffffffff0000000002000000050000000c0000000000000000000000000000000000ffffffff0000ffff01000500000000000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Configuration Data = 01000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information = 00000000000000000100000000000100	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\5\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\15\Component Information = 00000000000000000f00000000000f00	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\19\Component Information = 00000000000000001300000000001300	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Component Information = 00000000000000000400000000000400	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\18\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Component Information = 600000000000000000000000ffffffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\20\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\6\Component Information = 00000000000000000600000000000600	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\9\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information = 280000000000000000000000ffffffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\9\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\2	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Identifier = "56bb9bc0-00000000-A"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\17	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\2\Component Information = 00000000000000000200000000000200	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\14	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\22\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\8\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\14\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\17\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\10\Component Information = 00000000000000000a00000000000a00	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\12\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\16	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\19	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier = "ISA"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\15\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0\Configuration Data = 01000000000000000000000001000000050000001000000000000000000000000000000000020000000000000000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\10\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data = 0000000000000000000000000100000005000000e8030000000000000000000000000000e890ff3f000000002900000000000000000000000000000000100000000000000100000000000000001000000000000000100000000000000100000001f8ffff002000000000000000e00900000000000100000000000000000010000000000000a0620000000000010000000000000000a072000000000000600e00000000000100000001f8ffff000081000000000000a0010000000000010000000000000000a082000000000000400000000000000100000001f8ffff00e082000000000000b00000000000000100000000000000009083000000000000800800000000000100000001f8ffff00108c000000000000b01e0000000000010000000000000000c0aa000000000000e0220000000000010000000000000000a0cd00000000000060320000000000010000000000000000000001000000000000cc00000000000100000001f8ffff0000cc010000000000007402000000000100000000000000000040040000000000004000000000000100000000000000000080040000000000800900000000000100000000000000008089040000000000000200000000000100000001f8ffff00808b04000000000030030000000000010000000000000000b08e040000000000800000000000000100000001f8ffff00308f04000000000080010000000000010000000000000000b090040000000000506f0b000000000100000001f8ffff000000100000000000a02b0000000000010000000000000000a02b100000000000f0962e000000000100000001f8ffff0090c23e000000000010250000000000010000000000000000a0e73e0000000000f001000000000003000000000000000090e93e00000000009005000000000001000000000000000020ef3e0000000000900200000000000200000001f8ffff00b0f13e0000000000506e000000000001000000000000000000603f0000000000002000000000000100000001f8ffff0000803f0000000000800b00000000000100000001f8ffff00808b3f0000000000100100000000000100000001f8ffff00908c3f000000000030000000000000010000000000000000c08c3f0000000000f05400000000000100000001f8ffff00b0e13f0000000000001800000000000100000001f8ffff00b0f93f0000000000000300000000000200000001f8ffff00b0fc3f000000000040020000000000020000000000000000f0fe3f0000000000400000000000000200000001f8ffff0030ff3f000000000080000000000000030000000000000000b0ff3f0000000000400000000000000400000001f8ffff00f0ff3f000000000010000000000000010000000000000000000c000000000000000400000000000200000001f8ffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\14\Component Information = 00000000000000000e00000000000e00	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Component Information = 00000000000000000100000000000100	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\14\Component Information = 00000000000000000e00000000000e00	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Component Information = 00000000000000000400000000000400	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\7	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information = 280000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\16\Identifier = "AMD64 Family 25 Model 97 Stepping 2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data = 01000000000000000000000000000000	regedit.exe

Modifies Internet Explorer Protected Mode 1 TTPs 10 IoCs

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "0"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "0"	regedit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\IDN\HKeyRoot = "2147483649"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Transitions\PageBack = "progid:DXImageTransform.Microsoft.Fade(Duration=0.4)"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\MOVSYSCARET\HKeyRoot = "2147483649"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8C63DABA-CBA8-4B5D-A0F7-AE00F2920929}\Compatibility Flags = "1024"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{92ED88BF-879E-448F-B6B6-A385BCEB846D}\Compatibility Flags = "1024"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\IntranetCompatibilityMode	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{DE233AFF-8BD5-457E-B7F0-702DBEA5A828}\Compatibility Flags = "1024"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{eeed4c20-7f1b-11ce-be57-00aa0051fe20}	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\IDN_SHOWPUNY\DefaultValue = "0"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{053017A8-53F7-4EA3-AA38-A4CCAAF1F9E7}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AboutURLs\PostNotCached = "res://ieframe.dll/repost.htm"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{98cb4060-d3e7-42a1-8d65-949d34ebfe14}	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{C46C1BEE-3C52-11D0-9200-848C1D000000}\Compatibility Flags = "1024"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_SSLUX	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{F3834A2B-19CF-4A90-BE1D-ECC410D9DA09}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\SSLREV\Text = "Check for server certificate revocation"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{09AF76DD-6988-4664-97D0-362F1011E311}\MasterCLSID = "{053017A8-53F7-4EA3-AA38-A4CCAAF1F9E7}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8cec58ae-07a1-11d9-b15e-000d56bfe6ee}\AppPath = "C:\\Windows"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{CDAF9CEC-F3EC-4B22-ABA3-9726713560F8}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\SUGGESTED_SITES\RegPath = "SOFTWARE\\Microsoft\\Internet Explorer\\Suggested Sites"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\INTERNATIONAL\IDN_INTRANET\PlugUIText = "@C:\\Windows\\System32\\inetcpl.cpl,-6003"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{8D670533-270B-4549-B19B-414FB9C6EBDB}\Compatibility Flags = "1024"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\Roaming\SearchSuggestion	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{777D0B4C-75C9-4874-ABFF-80B4BE8DC532}\CompatibilityFlags = "0x00"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Extensions Off Page = "about:NoAdd-ons"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\Restriction Policies\Hashes\8335CB2F7E042A1DF46954B65C073A7BF43B2EC3\Policy = "4294967295"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{1C15D484-911D-11D2-B632-00C04F79498E}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\USE_THEMES\ValueName = "UseThemes"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\FeatureControl\FEATURE_BLOCK_LMZ_OBJECT\PresentationHost.exe = "1"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{DA986D7D-CCAF-47B2-84FE-BFA1549BEBF9}\DllName = "ZeonIEFavClient.dll"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C8999AEC-AECE-4E27-9BCB-5358B13F9FF9}	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{A3796166-A03C-418A-AF3A-060115D4E478}\Compatibility Flags = "1024"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{ABE40035-27C3-4A2F-8153-6624471608AF}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{84926CA0-2941-101C-816F-0E6013114B7F}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{21347690-EC41-4F9A-8887-1F4AEE672439}\BlockType = "0x01;0x01;0x01;0x01;0x01;0x01;0x01;0x01;0x01"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{00021401-0000-0000-C000-000000000046}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{101D2283-EED9-4BA2-8F3F-23DB860946EB}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{4A7C84E2-E95C-43C6-8DD3-03ABCD0EB60E}\BlockType = "0x02"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{00020810-0000-0000-c000-000000000046}\Version = "0.0.0.0-11.65535.65535.65535"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{47206204-5ECA-11D2-960F-00C04F8EE628}\Compatibility Flags = "1024"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\TLS1.3\CheckedValue = "8192"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PICTS\CheckedValue = "yes"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{28953661-0231-41DB-8986-21FF4388EE9B}	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D92D7607-05D9-4DD8-B68B-D458948FB883}\Compatibility Flags = "1024"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\MULTIMEDIA\PLACEHOLDERS\HKeyRoot = "2147483649"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{121E91E7-E915-4AA6-89F3-BA62D10A4C49}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\ACCESSIBILITY\CARETBROWSING\PlugUIText = "@C:\\Windows\\System32\\inetcpl.cpl,-4918"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\ACR\PlugUIText = "@C:\\Windows\\System32\\inetcpl.cpl,-4913"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\FTPPASV\Type = "checkbox"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{E38FD381-6404-4041-B5E9-B2739258941F}\Compatibility Flags = "1024"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\CRYPTO\CD_LMZ_LOCKDOWN\Text = "Allow active content from CDs to run on my computer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{BBACBAFD-FA5E-4079-8B33-00EB9F13D4AC}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\UnattendBackup\LockToolbars	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{17E3A1C3-EA8A-4970-AF29-7F54610B1D4C}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B09DE715-87C1-11D1-8BE3-0000F8754DA1}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\FTPPASV\Text = "Use Passive FTP (for firewall and DSL modem compatibility)"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{B0406343-B0C5-11D0-89A9-00A0C9054129}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\AUTOAPPEND	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{724D43A0-0D85-11D4-9908-00400523E39A}\CompatibilityFlags = "0x00"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Capabilities\FileAssociations\.htm = "IE.AssocFile.HTM"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{69ABB8E4-3A44-461C-93BC-C3BB6BDF2DF3}\BlockType = "0x40"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\ActiveX Compatibility\{D9998BD0-7957-11D2-8FED-00606730D3AA}\Compatibility Flags = "1024"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\HIDENEWEDGEBUTTON\RegPoliciesPath = "SOFTWARE\\Policies\\Microsoft\\Internet Explorer\\Main"	regedit.exe

Modifies Internet Explorer start page 1 TTPs 2 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\MAIN\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{60677105-477D-45F8-B745-C2450B35F0D0}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1E6B801-3EC6-47E4-8B46-9ED3EC967B9E}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DeviceDisplayObject\InterfaceClass\{a5dcbf10-6530-11d2-901f-00c04fb951ed}\DeviceDisplayStatus	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5593941A-F61C-49C3-85F1-D00EBF0D4EB2}\InprocServer32\ThreadingModel = "Both"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3059008E-98B5-11CF-BB82-00AA00BDCE0B}\TypeLib	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D1BBB611-641B-4B9C-9A7F-030E0CB6845E}\InProcServer32\ = "C:\\Windows\\SysWOW64\\windows.storage.dll"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C20769F3-858D-316A-BE6D-C347A47948AD}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{52A2AAAE-085D-4187-97EA-8C30DB990436}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E113A05-E209-4549-BB25-5E0DB691CB05}\ = "IConnectionCost2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E847030C-BBBA-4657-AF6D-484AA42BF1FE}\NumMethods\ = "55"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3050f4f8-98b5-11cf-bb82-00aa00bdce0b}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1FED3DF6-2C3F-461A-BA20-4B1DF6569A9B}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{37B03544-A4C8-11D2-B634-00C04F79498E}\VersionIndependentProgID	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{70945a09-331a-5e40-b854-66b7a3233bab}\ProxyStubClsid32\ = "{6db7cd52-e3b7-4ecc-bb1f-388aeef6bb50}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{df3460ae-d92d-40f3-b5cd-f83259936f23}\InProcServer32\ThreadingModel = "Both"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6f2eea36-de40-55b4-90c3-255673f71b2e}\ = "__FIAsyncOperation_1_Windows__CDevices__CSmartCards__CSmartCardCryptogramMaterialPossessionProof"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{917e1105-0647-5793-9d50-befe225f0f2f}\ProxyStubClsid32\ = "{13F6A0B6-57AF-4BA7-ACAA-614BC89CA9D7}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{96274226-3195-4CDE-B0A0-0F6256C7A65A}\ = "CDPComNearShareBroker"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B60F6C81-8AE9-57AB-AF04-CB412095641E}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BD8ACF0D-F617-4CF7-8C88-D050B71D9E1B}\ProxyStubClsid32\ = "{3FBF60BD-90B2-2C2F-7286-128BBCF72015}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{38F03426-E83B-4E68-B65B-DCAE73304838}\InprocServer32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E4A9120-DA3E-5F31-8739-405A3B2DBFB5}\ProxyStubClsid32\ = "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A5EFE073-B16F-474f-9F3E-9F8B497A3E08}\NumMethods	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44431C59-C5EC-4253-94F7-27563A8A242F}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C2D211A1-A6D4-49B5-9704-D74CB4DFF1EE}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{39ccc360-e53a-4227-b72e-2dc741a6e671}\ProxyStubClsid32\ = "{7CD4F369-6379-4EBB-86D4-87DA8E63CA3B}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{94855A3B-5CA2-32CF-B1AB-48FD3915822C}\ProxyStubClsid32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{c4bb1568-6c2f-5094-8e49-6b2fbfe5c0ba}\ProxyStubClsid32\ = "{ec4db96f-6872-4903-a448-6dffc454ae6d}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.library-ms\ShellNew\Config	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5645C8C2-E277-11CF-8FDA-00AA00A14F93}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{53BA4BBB-1DAF-5E2B-9086-C346AA909544}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4F4DD15E-F431-4536-AEE8-AF20BA847A33}\TypeLib\ = "{E6DA930B-BBA5-44DF-AC6F-FE60C1EDDEC8}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mpegfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B3B76E11-BD89-492C-A174-136D65742E96}\ = "IBackgroundCopyJobInternal2"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{278C33B5-A0E9-4CF7-A4B6-3CE41F94FCD6}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3050F820-98B5-11CF-BB82-00AA00BDCE0B}\ProxyStubClsid32	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{63F62086-85B5-4F56-83AF-B2BA7122F9C8}\NumMethods\ = "7"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.FLAC\shell\Enqueue\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6D2EF172-8AE3-572E-AE44-8EE3FD49D19F}\ = "__FIIterable_1___FIKeyValuePair_2_HSTRING_Windows__CApplicationModel__CWallet__CWalletVerb"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E39C892-B7CB-4BEF-A47B-39C8A19C618B}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5CBB1F47-FBA5-33B9-9D4A-57D6E3D133D2}\TypeLib	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{945F341F-DF0F-41D1-ADAE-5B9DABBB2139}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0EC325A2-D5C2-5806-996A-18EE534279AD}\ProxyStubClsid32\ = "{F3CCAE10-A927-4D4E-9138-4A513C4B10FA}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{588F905E-574C-4490-B04A-B739C0AC1C76}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B7F2F74D-BF9C-5721-BF6E-03F1B4409588}\ProxyStubClsid32\ = "{4AA53027-562B-4653-A8EF-9B92FF74ADA6}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DefragEngine.DefragEngine.1\CLSID	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{92b02cd3-aa6e-573d-bc03-8d2309cba3eb}\ProxyStubClsid32\ = "{11659a23-5884-4d1b-9cf6-67d6f4f90b36}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{c0f5b779-8ac0-59e0-9269-a741a6f35e76}\ = "__FIIterable_1_Windows__CInternal__CStateRepository__CPackage"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{094166ef-ae5f-5315-a3bf-fe54e8c35fcd}\ProxyStubClsid32\ = "{0b4c227f-2394-43ff-ba59-bc762f5c46ea}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\PackageRepository\Extensions\windows.protocol\ms-cxh\AppX3p914qnpgw4hwj856jw2y286v7d4qnzh\Microsoft.Windows.CloudExperienceHost_10.0.22621.2506_neutral_neu	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{e471b446-3a01-5190-89c9-15e740374cfc}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{905b55a8-77f0-4d28-80dd-e46b1412343f}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5A625EA4-A89F-4EB2-A45A-9AD4E37D4B00}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\ProgID	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D7D7EF7D-AC20-59B5-8CAD-AECC108D3065}\ProxyStubClsid32\ = "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{d8cc81b3-171d-4e8b-8663-79cc87408d04}\ = "__x_Windows_CInternal_CStateRepository_CIPackagePolicy"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{88E30EAB-F3B7-420B-B086-8A80C07D910D}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2D930225-986B-574D-7950-0ADD47F5D706}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0E84CCEB-709B-52D2-A663-EC5130862A9B}\ProxyStubClsid32\ = "{3FBF60BD-90B2-2C2F-7286-128BBCF72015}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{32D4EB0E-0FCA-41CD-A6BA-C49750CD92F0}\ProxyStubClsid32\ = "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{B8776114-9ADF-50E8-B67F-22E0F1372F45}\ProxyStubClsid32\ = "{95E15D0A-66E6-93D9-C53C-76E6219D3341}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EDC20EF1-F931-59F6-8D25-38A177958110}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FF9CE68E-060D-4120-81F9-F3061C703225}\ProxyStubClsid32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3f0613fc-b71a-464e-a11d-5b881a56cefa}	regedit.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2264	notepad.exe

Runs .reg file with regedit 3 IoCs

pid	Process
1544	regedit.exe
2364	regedit.exe
1648	regedit.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2364	regedit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\regedit.exe
regedit.exe "C:\Users\Admin\AppData\Local\Temp\win.reg"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies WinLogon for persistence
- Modifies Windows Defender notification settings
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Checks BIOS information in registry
- Modifies system executable filetype association
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Installs/modifies Browser Helper Object
- Event Triggered Execution: Netsh Helper DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Runs .reg file with regedit
- Suspicious behavior: GetForegroundWindowSpam
PID:2364

C:\Windows\system32\notepad.exe
"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\win.reg"
1⤵
- Opens file in notepad (likely ransom note)
PID:2264

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\win.reg"
1⤵
- Adds autorun key to be loaded by Explorer.exe on startup
- Modifies Windows Defender notification settings
- UAC bypass
- Windows security bypass
- Boot or Logon Autostart Execution: Active Setup
- Event Triggered Execution: Image File Execution Options Injection
- Manipulates Digital Signatures
- Checks BIOS information in registry
- Modifies system executable filetype association
- Hijack Execution Flow: Executable Installer File Permissions Weakness
- Installs/modifies Browser Helper Object
- Event Triggered Execution: Netsh Helper DLL
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Modifies registry class
- Runs .reg file with regedit
PID:1648

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\AppData\Local\Temp\win.reg"
1⤵
- Runs .reg file with regedit
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Browser Extensions

T1176

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

AppInit DLLs

T1546.010

Change Default File Association

T1546.001

Component Object Model Hijacking

T1546.015

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hijack Execution Flow

T1574

Executable Installer File Permissions Weakness

T1574.005

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1648-2-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/1648-3-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/2364-0-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download
memory/2364-1-0x00000000003D0000-0x00000000003D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads