Analysis
-
max time kernel
236s -
max time network
459s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
19-11-2024 19:36
Static task
static1
URLScan task
urlscan1
General
Malware Config
Extracted
Family
sality
C2
http://89.119.67.154/testo5/
http://kukutrustnet777.info/home.gif
http://kukutrustnet888.info/home.gif
http://kukutrustnet987.info/home.gif
Extracted
Family
berbew
C2
http://crutop.nu/index.php
http://devx.nm.ru/index.php
http://ros-neftbank.ru/index.php
http://master-x.com/index.php
http://www.redline.ru/index.php
http://cvv.ru/index.php
http://hackers.lv/index.php
http://fethard.biz/index.php
http://crutop.ru/index.php
http://kaspersky.ru/index.php
http://color-bank.ru/index.php
http://adult-empire.com/index.php
http://virus-list.com/index.php
http://trojan.ru/index.php
http://xware.cjb.net/index.htm
http://konfiskat.org/index.htm
http://parex-bank.ru/index.htm
http://fethard.biz/index.htm
http://ldark.nm.ru/index.htm
http://gaz-prom.ru/index.htm
http://promo.ru/index.htm
http://potleaf.chat.ru/index.htm
http://kadet.ru/index.htm
http://cvv.ru/index.htm
http://crutop.nu/index.htm
http://crutop.ru/index.htm
http://kaspersky.ru/index.htm
http://kidos-bank.ru/index.htm
http://kavkaz.ru/index.htm
Signatures
-
Berbew family
-
Floxif family
-
Gh0st RAT payload 3 IoCs
resource yara_rule behavioral1/files/0x001400000002ad83-1307.dat family_gh0strat behavioral1/files/0x001700000002b19a-3375.dat family_gh0strat behavioral1/files/0x001a00000002ad5f-1249.dat family_gh0strat -
Gh0strat family
-
Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" budha.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" budha.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" virussign.com_0a5dc79d0d544940287542da52174e49.exe -
Sality family
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" budha.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe -
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x001900000002af6f-2273.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x001900000002af6f-2273.dat acprotect -
Executes dropped EXE 36 IoCs
pid Process 7592 virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe 4908 virussign.com_0a5dc79d0d544940287542da52174e49.exe 4364 virussign.com_0a6b3609140dc5fd809d0c4e0eb28faa.exe 3164 virussign.com_0a55d8243bf43b45f0c7b8f8cc014f86.exe 3176 HWlbzRVnrpAYCHo.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8784 budha.exe 8328 virussign.com_00b04897fa78765eb45c2f767d57794c.exe 8312 virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe 7024 virussign.com_00b841690d05237253b7e73f00e5e5b5.exe 412 virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe 8104 CTS.exe 5772 CTS.exe 7876 virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe 7944 CTS.exe 7908 CTS.exe 8048 virussign.com_00efcdd352a4c735f8e37a49907691e4.exe 8016 CTS.exe 8100 CTS.exe 8120 virussign.com_00f25bb046fb84430a4a91343df2c4af.exe 848 CTS.exe 6452 virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe 3956 virussign.com_00efcdd352a4c735f8e37a49907691e4.exe 3056 virussign.com_00f25bb046fb84430a4a91343df2c4af.exe 6972 virussign.com_00b04897fa78765eb45c2f767d57794c.exe 664 virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe 2104 virussign.com_00b841690d05237253b7e73f00e5e5b5.exe 4952 CTS.exe 4804 CTS.exe 3296 CTS.exe 5048 CTS.exe 3144 CTS.exe 6028 virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe 4760 CTS.exe 4604 CTS.exe -
Loads dropped DLL 21 IoCs
pid Process 4144 CTS.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" budha.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" budha.exe -
Adds Run key to start application 2 TTPs 30 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00f25bb046fb84430a4a91343df2c4af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b841690d05237253b7e73f00e5e5b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00efcdd352a4c735f8e37a49907691e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00f25bb046fb84430a4a91343df2c4af.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b04897fa78765eb45c2f767d57794c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b841690d05237253b7e73f00e5e5b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00b04897fa78765eb45c2f767d57794c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00efcdd352a4c735f8e37a49907691e4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" CTS.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\CTS = "C:\\Windows\\CTS.exe" virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" budha.exe -
Enumerates connected drives 3 TTPs 20 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\M: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\S: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\E: budha.exe File opened (read-only) \??\H: budha.exe File opened (read-only) \??\H: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\K: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\L: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\R: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\G: budha.exe File opened (read-only) \??\E: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\J: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\O: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\Q: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\I: budha.exe File opened (read-only) \??\J: budha.exe File opened (read-only) \??\G: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\N: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\P: virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened (read-only) \??\E: virussign.com_0a5dc79d0d544940287542da52174e49.exe -
resource yara_rule behavioral1/files/0x001900000002af6f-2273.dat upx behavioral1/memory/3940-6596-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6609-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6595-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6670-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6846-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6972-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6971-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6669-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6585-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6610-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6587-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6588-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6586-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6583-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6594-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6982-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6986-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6989-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6991-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-6992-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7014-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7015-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7028-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7029-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7068-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/memory/3940-7069-0x00000000008A0000-0x000000000195A000-memory.dmp upx behavioral1/files/0x000d00000002ba5a-9442.dat upx -
Drops file in Program Files directory 33 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ius877E.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iuser.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isc876D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj879F.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ctor.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files\7-Zip\7z.exe virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isp863C.tmp\setup.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\Dot873D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iscript.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\Setup.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKe872C.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP877F.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\ius877E.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\Dot873D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsProBE.tlb virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKe872C.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\cto875D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\cto875D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\objectps.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\iKernel.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isp864E.tmp\iGdi.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\Obj879F.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsProBE.tlb virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isp864E.tmp\temp.000 virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isc876D.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\IsP877F.tmp virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\iKernel.rgs virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\IGDI.dll virussign.com_0a5dc79d0d544940287542da52174e49.exe File opened for modification C:\Program Files\7-Zip\7zG.exe virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File created C:\Program Files (x86)\Common Files\InstallShield\Professional\RunTime\0701\Intel32\isp863C.tmp\temp.000 virussign.com_0a5dc79d0d544940287542da52174e49.exe -
Drops file in Windows directory 34 IoCs
description ioc Process File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe virussign.com_00f25bb046fb84430a4a91343df2c4af.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe File created C:\Windows\CTS.exe virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe File created C:\Windows\CTS.exe virussign.com_00b04897fa78765eb45c2f767d57794c.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\e5ad16b virussign.com_0a5dc79d0d544940287542da52174e49.exe File created C:\Windows\e5af89a budha.exe File created C:\Windows\CTS.exe virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe File created C:\Windows\CTS.exe virussign.com_00efcdd352a4c735f8e37a49907691e4.exe File created C:\Windows\CTS.exe CTS.exe File opened for modification C:\Windows\SYSTEM.INI virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe File created C:\Windows\CTS.exe virussign.com_00efcdd352a4c735f8e37a49907691e4.exe File created C:\Windows\CTS.exe virussign.com_00b841690d05237253b7e73f00e5e5b5.exe File created C:\Windows\CTS.exe virussign.com_00b841690d05237253b7e73f00e5e5b5.exe File created C:\Windows\CTS.exe CTS.exe File created C:\Windows\CTS.exe virussign.com_00f25bb046fb84430a4a91343df2c4af.exe File created C:\Windows\CTS.exe virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe File created C:\Windows\CTS.exe virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe File created C:\Windows\e5a8185 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe File created C:\Windows\CTS.exe virussign.com_00b04897fa78765eb45c2f767d57794c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process 768 4364 WerFault.exe -
System Location Discovery: System Language Discovery 1 TTPs 20 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_0a5dc79d0d544940287542da52174e49.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language budha.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00f25bb046fb84430a4a91343df2c4af.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_0a55d8243bf43b45f0c7b8f8cc014f86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_0a5dc79d0d544940287542da52174e49.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b04897fa78765eb45c2f767d57794c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00efcdd352a4c735f8e37a49907691e4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00f25bb046fb84430a4a91343df2c4af.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b841690d05237253b7e73f00e5e5b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b04897fa78765eb45c2f767d57794c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00b841690d05237253b7e73f00e5e5b5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language virussign.com_00efcdd352a4c735f8e37a49907691e4.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier firefox.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B14-E59D-11D2-B40B-00A024B9DDDD} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1ED19966-1493-4539-B9F5-97A6556CE8F8}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DE38-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B14-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{E3CD7A86-04E4-4B47-88E8-3EE03A3DEE56}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91814EC1-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2A3A842-FBA3-49D4-8806-7734716364A2} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{ECBE1E54-3649-4287-9888-D9FB133CAE0D}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{44D61997-B7D4-11D2-80BA-00104B1F6CEA}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{251753FA-FB3B-11D2-8842-00C04F72F303} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B16-E59D-11D2-B40B-00A024B9DDDD} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303} virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD0749C-12DC-4D2B-A4F6-9E52F0F38A6C}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F9922A2-F026-11D2-8822-00C04F72F303}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{39040274-3D36-11D3-88EE-00C04F72F303}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DAB9BF17-267D-11D3-88B6-00C04F72F303}\ = "ISetupTextSubstitution" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4E26CAD5-1B59-4D1D-9063-2D91314C9E45}\ = "ISetupMainWindow4" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E3CD7A86-04E4-4B47-88E8-3EE03A3DEE56}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1169A235-14D9-4488-8B56-58ECE9C57002} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91814EC3-B5F0-11D2-80B9-00104B1F6CEA}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9CFCFE67-0BB8-43E0-8425-378D0A02ACE4}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E1B9357F-24B9-11D3-88B2-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C5C8B37-CCB7-11D5-ABEC-00B0D0238DF5}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6332-D8B1-11D2-80C5-00104B1F6CEA}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0BA4BA22-2EF0-11D3-88C8-00C04F72F303}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7BB118F1-6D5B-470E-82D0-AFB042724560}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1ED19966-1493-4539-B9F5-97A6556CE8F8}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DADAB2-28A6-11D3-88BA-00C04F72F303}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\WOW6432Node\Interface virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00345390-4F77-11D3-A908-00105A088FAC}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2583251F-0A04-11D3-886B-00C04F72F303}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF57A6F1-4101-11D3-88F6-00C04F72F303}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B1B8830-C559-11D3-B289-00C04F59FBE9} virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\USER\S-1-5-21-1537126222-899333903-2037027349-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{00345390-4F77-11D3-A908-00105A088FAC}\ = "ISetupMultiMedia" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9BD0749C-12DC-4D2B-A4F6-9E52F0F38A6C}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{39040274-3D36-11D3-88EE-00C04F72F303} virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{112EB4F0-5A48-11D3-A90A-00105A088FAC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B697780-DBBC-11D2-80C7-00104B1F6CEA}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A36ECFBE-FAAA-417D-9D41-7FEF98FDE554} virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3D8B6331-D8B1-11D2-80C5-00104B1F6CEA}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{80FDE82A-2CAA-11D3-88C3-00C04F72F303} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B964AF40-4AB7-11D3-A908-00105A088FAC} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8415DDF9-1C1D-11D3-889D-00C04F72F303}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2060-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AA7E2084-CB55-11D2-8094-00104B1F9838}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7D795704-435D-11D3-88FF-00C04F72F303}\TypeLib virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8C3C1B10-E59D-11D2-B40B-00A024B9DDDD}\ = "ISetupLogDB" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{761C8359-55AF-4E7B-9C83-C1A927E0F617}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9BD0749C-12DC-4D2B-A4F6-9E52F0F38A6C} virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8C3C1B11-E59D-11D2-B40B-00A024B9DDDD}\TypeLib\ = "{94636247-BC39-4B8B-A728-2D1FBEBFA76A}" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AA7E2062-CB55-11D2-8094-00104B1F9838}\TypeLib\Version = "1.0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B697780-DBBC-11D2-80C7-00104B1F6CEA}\ = "ISetupObjectClass" virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{CC096170-E2CB-11D2-80C8-00104B1F6CEA} virussign.com_0a5dc79d0d544940287542da52174e49.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{00345390-4F77-11D3-A908-00105A088FAC}\ProxyStubClsid32 virussign.com_0a5dc79d0d544940287542da52174e49.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\Virussign.2024.04.17.7z:Zone.Identifier firefox.exe -
Suspicious behavior: EnumeratesProcesses 35 IoCs
pid Process 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 8712 virussign.com_0a5dc79d0d544940287542da52174e49.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 8784 budha.exe 8784 budha.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 6348 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2592 firefox.exe Token: SeDebugPrivilege 2592 firefox.exe Token: SeDebugPrivilege 2592 firefox.exe Token: SeRestorePrivilege 3048 7zG.exe Token: 35 3048 7zG.exe Token: SeSecurityPrivilege 3048 7zG.exe Token: SeSecurityPrivilege 3048 7zG.exe Token: SeRestorePrivilege 5644 7zG.exe Token: 35 5644 7zG.exe Token: SeSecurityPrivilege 5644 7zG.exe Token: SeDebugPrivilege 7592 virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Token: SeDebugPrivilege 3940 virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe -
Suspicious use of FindShellTrayWindow 52 IoCs
pid Process 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 3048 7zG.exe 5644 7zG.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe -
Suspicious use of SendNotifyMessage 29 IoCs
pid Process 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe 6348 taskmgr.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe 2592 firefox.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 1240 wrote to memory of 2592 1240 firefox.exe 79 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4836 2592 firefox.exe 80 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 PID 2592 wrote to memory of 4576 2592 firefox.exe 81 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" virussign.com_0a5dc79d0d544940287542da52174e49.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" budha.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:832
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:432
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:980
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3332
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://samples.vx-underground.org/Samples/VirusSign%20Collection/2024.04/Virussign.2024.04.17.7z"2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://samples.vx-underground.org/Samples/VirusSign%20Collection/2024.04/Virussign.2024.04.17.7z3⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1980 -parentBuildID 20240401114208 -prefsHandle 1908 -prefMapHandle 1900 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {82dbcd29-d747-4516-8f06-f7ed85fc31d2} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" gpu4⤵PID:4836
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2400 -parentBuildID 20240401114208 -prefsHandle 2392 -prefMapHandle 2388 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38e05664-2f58-4ce5-8937-e74e4eb160ba} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" socket4⤵
- Checks processor information in registry
PID:4576
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3088 -childID 1 -isForBrowser -prefsHandle 3080 -prefMapHandle 3076 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 1404 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b681ceab-2157-4e3f-8d1a-a773dbe32cc1} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" tab4⤵PID:3096
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3640 -childID 2 -isForBrowser -prefsHandle 3540 -prefMapHandle 2940 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 1404 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd22df3f-0e64-4626-9368-ead2a93b20a8} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" tab4⤵PID:3268
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4796 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4792 -prefMapHandle 4788 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ab78d1d-56c9-4e4e-8e71-75ea9d632887} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" utility4⤵
- Checks processor information in registry
PID:1384
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5652 -childID 3 -isForBrowser -prefsHandle 5644 -prefMapHandle 5640 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1404 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c9a61c-6a6c-4625-8b47-0828ca9646ed} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" tab4⤵PID:3748
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5796 -childID 4 -isForBrowser -prefsHandle 5604 -prefMapHandle 5600 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1404 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dcfcde7-6ab5-45bf-aa7a-e4aad78e47a8} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" tab4⤵PID:2676
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5960 -childID 5 -isForBrowser -prefsHandle 5968 -prefMapHandle 5972 -prefsLen 27172 -prefMapSize 244658 -jsInitHandle 1404 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {877cb69a-e5b2-49cb-bdcc-61406820ac2d} 2592 "\\.\pipe\gecko-crash-server-pipe.2592" tab4⤵PID:4008
-
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Virussign.2024.04.17\" -spe -an -ai#7zMap15848:100:7zEvent325132⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3048
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:7940
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:7956
-
-
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\*\" -ad -an -ai#7zMap6540:2814:7zEvent42802⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5644
-
-
C:\Users\Admin\Desktop\virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe"C:\Users\Admin\Desktop\virussign.com_0a1d4487f10a804b16f13aa7f8e7ae1e.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:7592 -
C:\Users\Admin\AppData\Local\Temp\HWlbzRVnrpAYCHo.exeC:\Users\Admin\AppData\Local\Temp\HWlbzRVnrpAYCHo.exe3⤵
- Executes dropped EXE
PID:3176
-
-
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
PID:4144
-
-
-
C:\Users\Admin\Desktop\virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe"C:\Users\Admin\Desktop\virussign.com_0a2ae581dd8eed9d6349e530610d1d97.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3940
-
-
C:\Users\Admin\Desktop\virussign.com_0a5dc79d0d544940287542da52174e49.exe"C:\Users\Admin\Desktop\virussign.com_0a5dc79d0d544940287542da52174e49.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4908 -
C:\Users\Admin\Desktop\virussign.com_0a5dc79d0d544940287542da52174e49.exe-deleter3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:8712
-
-
-
C:\Users\Admin\Desktop\virussign.com_0a6b3609140dc5fd809d0c4e0eb28faa.exe"C:\Users\Admin\Desktop\virussign.com_0a6b3609140dc5fd809d0c4e0eb28faa.exe"2⤵
- Executes dropped EXE
PID:4364 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4364 -s 83⤵
- Program crash
PID:768
-
-
-
C:\Users\Admin\Desktop\virussign.com_0a55d8243bf43b45f0c7b8f8cc014f86.exe"C:\Users\Admin\Desktop\virussign.com_0a55d8243bf43b45f0c7b8f8cc014f86.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164 -
C:\Users\Admin\AppData\Local\Temp\budha.exe"C:\Users\Admin\AppData\Local\Temp\budha.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- System policy modification
PID:8784
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b04897fa78765eb45c2f767d57794c.exe"C:\Users\Admin\Desktop\virussign.com_00b04897fa78765eb45c2f767d57794c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8328 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:8104
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe"C:\Users\Admin\Desktop\virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8312 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:5772
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b841690d05237253b7e73f00e5e5b5.exe"C:\Users\Admin\Desktop\virussign.com_00b841690d05237253b7e73f00e5e5b5.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7024 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:7944
-
-
-
C:\Users\Admin\Desktop\virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe"C:\Users\Admin\Desktop\virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:412 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:7908
-
-
-
C:\Users\Admin\Desktop\virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe"C:\Users\Admin\Desktop\virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:7876 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:8016
-
-
-
C:\Users\Admin\Desktop\virussign.com_00efcdd352a4c735f8e37a49907691e4.exe"C:\Users\Admin\Desktop\virussign.com_00efcdd352a4c735f8e37a49907691e4.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8048 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:8100
-
-
-
C:\Users\Admin\Desktop\virussign.com_00f25bb046fb84430a4a91343df2c4af.exe"C:\Users\Admin\Desktop\virussign.com_00f25bb046fb84430a4a91343df2c4af.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:8120 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:848
-
-
-
C:\Users\Admin\Desktop\virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe"C:\Users\Admin\Desktop\virussign.com_00e71273b72350775e5ac4931aa8ee1b.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6452 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:4952
-
-
-
C:\Users\Admin\Desktop\virussign.com_00efcdd352a4c735f8e37a49907691e4.exe"C:\Users\Admin\Desktop\virussign.com_00efcdd352a4c735f8e37a49907691e4.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3956 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:4804
-
-
-
C:\Users\Admin\Desktop\virussign.com_00f25bb046fb84430a4a91343df2c4af.exe"C:\Users\Admin\Desktop\virussign.com_00f25bb046fb84430a4a91343df2c4af.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:3056 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:3296
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b04897fa78765eb45c2f767d57794c.exe"C:\Users\Admin\Desktop\virussign.com_00b04897fa78765eb45c2f767d57794c.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6972 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:5048
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe"C:\Users\Admin\Desktop\virussign.com_00b223039f4b6c931d7326a7c9cd9a01.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:664 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:3144
-
-
-
C:\Users\Admin\Desktop\virussign.com_00b841690d05237253b7e73f00e5e5b5.exe"C:\Users\Admin\Desktop\virussign.com_00b841690d05237253b7e73f00e5e5b5.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:2104 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:4760
-
-
-
C:\Users\Admin\Desktop\virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe"C:\Users\Admin\Desktop\virussign.com_00c3516bb254f2d8ccbfa20ba5a543f7.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:6028 -
C:\Windows\CTS.exe"C:\Windows\CTS.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
PID:4604
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /02⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:6348
-
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"2⤵PID:4252
-
-
C:\Users\Admin\Desktop\virussign.com_1ab17b7d805790288b7f18b38ffb494b.exe"C:\Users\Admin\Desktop\virussign.com_1ab17b7d805790288b7f18b38ffb494b.exe"2⤵PID:6032
-
C:\Windows\SysWOW64\Dobfjc32.exeC:\Windows\system32\Dobfjc32.exe3⤵PID:1188
-
C:\Windows\SysWOW64\Delngmnd.exeC:\Windows\system32\Delngmnd.exe4⤵PID:8972
-
C:\Windows\SysWOW64\Dlffdg32.exeC:\Windows\system32\Dlffdg32.exe5⤵PID:8272
-
C:\Windows\SysWOW64\Doebpb32.exeC:\Windows\system32\Doebpb32.exe6⤵PID:8580
-
C:\Windows\SysWOW64\Dfljap32.exeC:\Windows\system32\Dfljap32.exe7⤵PID:7544
-
C:\Windows\SysWOW64\Dijgmk32.exeC:\Windows\system32\Dijgmk32.exe8⤵PID:5696
-
C:\Windows\SysWOW64\Dpdoje32.exeC:\Windows\system32\Dpdoje32.exe9⤵PID:5324
-
C:\Windows\SysWOW64\Dbbkfa32.exeC:\Windows\system32\Dbbkfa32.exe10⤵PID:5452
-
C:\Windows\SysWOW64\Deagbl32.exeC:\Windows\system32\Deagbl32.exe11⤵PID:8536
-
C:\Windows\SysWOW64\Dpflpe32.exeC:\Windows\system32\Dpflpe32.exe12⤵PID:8504
-
C:\Windows\SysWOW64\Dbehlq32.exeC:\Windows\system32\Dbehlq32.exe13⤵PID:7756
-
C:\Windows\SysWOW64\Eiophkqe.exeC:\Windows\system32\Eiophkqe.exe14⤵PID:8664
-
C:\Windows\SysWOW64\Eoliqa32.exeC:\Windows\system32\Eoliqa32.exe15⤵PID:6696
-
C:\Windows\SysWOW64\Eefamlfi.exeC:\Windows\system32\Eefamlfi.exe16⤵PID:7824
-
C:\Windows\SysWOW64\Eonefa32.exeC:\Windows\system32\Eonefa32.exe17⤵PID:8856
-
C:\Windows\SysWOW64\Efemgo32.exeC:\Windows\system32\Efemgo32.exe18⤵PID:6408
-
C:\Windows\SysWOW64\Eicicj32.exeC:\Windows\system32\Eicicj32.exe19⤵PID:6728
-
C:\Windows\SysWOW64\Epnbpddl.exeC:\Windows\system32\Epnbpddl.exe20⤵PID:7160
-
C:\Windows\SysWOW64\Efhjmnki.exeC:\Windows\system32\Efhjmnki.exe21⤵PID:6400
-
C:\Windows\SysWOW64\Ehifdf32.exeC:\Windows\system32\Ehifdf32.exe22⤵PID:7808
-
C:\Windows\SysWOW64\Eppofd32.exeC:\Windows\system32\Eppofd32.exe23⤵PID:4720
-
C:\Windows\SysWOW64\Efjgbnif.exeC:\Windows\system32\Efjgbnif.exe24⤵PID:9028
-
C:\Windows\SysWOW64\Eoekgpfa.exeC:\Windows\system32\Eoekgpfa.exe25⤵PID:460
-
C:\Windows\SysWOW64\Ebqggo32.exeC:\Windows\system32\Ebqggo32.exe26⤵PID:3488
-
C:\Windows\SysWOW64\Feoccjno.exeC:\Windows\system32\Feoccjno.exe27⤵PID:3316
-
C:\Windows\SysWOW64\Flilpd32.exeC:\Windows\system32\Flilpd32.exe28⤵PID:236
-
C:\Windows\SysWOW64\Fbcdmomh.exeC:\Windows\system32\Fbcdmomh.exe29⤵PID:2116
-
C:\Windows\SysWOW64\Fimlji32.exeC:\Windows\system32\Fimlji32.exe30⤵PID:8344
-
C:\Windows\SysWOW64\Flkifd32.exeC:\Windows\system32\Flkifd32.exe31⤵PID:9016
-
C:\Windows\SysWOW64\Fojebp32.exeC:\Windows\system32\Fojebp32.exe32⤵PID:1148
-
C:\Windows\SysWOW64\Fgamcmco.exeC:\Windows\system32\Fgamcmco.exe33⤵PID:6868
-
C:\Windows\SysWOW64\Fioiohbb.exeC:\Windows\system32\Fioiohbb.exe34⤵PID:6756
-
C:\Windows\SysWOW64\Fpialb32.exeC:\Windows\system32\Fpialb32.exe35⤵PID:4932
-
C:\Windows\SysWOW64\Fchnhn32.exeC:\Windows\system32\Fchnhn32.exe36⤵PID:6496
-
C:\Windows\SysWOW64\Fefjdi32.exeC:\Windows\system32\Fefjdi32.exe37⤵PID:3376
-
C:\Windows\SysWOW64\Flpbacoc.exeC:\Windows\system32\Flpbacoc.exe38⤵PID:2120
-
C:\Windows\SysWOW64\Fidbjh32.exeC:\Windows\system32\Fidbjh32.exe39⤵PID:9032
-
C:\Windows\SysWOW64\Fhgcfdeg.exeC:\Windows\system32\Fhgcfdeg.exe40⤵PID:1152
-
C:\Windows\SysWOW64\Fpnkgbfj.exeC:\Windows\system32\Fpnkgbfj.exe41⤵PID:2612
-
C:\Windows\SysWOW64\Foakbo32.exeC:\Windows\system32\Foakbo32.exe42⤵PID:1884
-
C:\Windows\SysWOW64\Gekcoida.exeC:\Windows\system32\Gekcoida.exe43⤵PID:2188
-
C:\Windows\SysWOW64\Ggjpil32.exeC:\Windows\system32\Ggjpil32.exe44⤵PID:5564
-
C:\Windows\SysWOW64\Giileg32.exeC:\Windows\system32\Giileg32.exe45⤵PID:6244
-
C:\Windows\SysWOW64\Gcaqnm32.exeC:\Windows\system32\Gcaqnm32.exe46⤵PID:6324
-
C:\Windows\SysWOW64\Ggmlokia.exeC:\Windows\system32\Ggmlokia.exe47⤵PID:8160
-
C:\Windows\SysWOW64\Gliegbgi.exeC:\Windows\system32\Gliegbgi.exe48⤵PID:6216
-
C:\Windows\SysWOW64\Gohacnfl.exeC:\Windows\system32\Gohacnfl.exe49⤵PID:4540
-
C:\Windows\SysWOW64\Ggoidkgo.exeC:\Windows\system32\Ggoidkgo.exe50⤵PID:3024
-
C:\Windows\SysWOW64\Gjmeqffb.exeC:\Windows\system32\Gjmeqffb.exe51⤵PID:5348
-
C:\Windows\SysWOW64\Gpgnmqno.exeC:\Windows\system32\Gpgnmqno.exe52⤵PID:6844
-
C:\Windows\SysWOW64\Gedfeglf.exeC:\Windows\system32\Gedfeglf.exe53⤵PID:1752
-
C:\Windows\SysWOW64\Gomjnm32.exeC:\Windows\system32\Gomjnm32.exe54⤵PID:5224
-
C:\Windows\SysWOW64\Hgdbpj32.exeC:\Windows\system32\Hgdbpj32.exe55⤵PID:484
-
C:\Windows\SysWOW64\Hjbolf32.exeC:\Windows\system32\Hjbolf32.exe56⤵PID:2988
-
C:\Windows\SysWOW64\Hlqkha32.exeC:\Windows\system32\Hlqkha32.exe57⤵PID:2016
-
C:\Windows\SysWOW64\Hcjcdk32.exeC:\Windows\system32\Hcjcdk32.exe58⤵PID:5652
-
C:\Windows\SysWOW64\Hfipqg32.exeC:\Windows\system32\Hfipqg32.exe59⤵PID:5524
-
C:\Windows\SysWOW64\Hhglmb32.exeC:\Windows\system32\Hhglmb32.exe60⤵PID:4800
-
C:\Windows\SysWOW64\Hfklff32.exeC:\Windows\system32\Hfklff32.exe61⤵PID:9176
-
C:\Windows\SysWOW64\Hcompkdh.exeC:\Windows\system32\Hcompkdh.exe62⤵PID:1776
-
C:\Windows\SysWOW64\Hfnilfcl.exeC:\Windows\system32\Hfnilfcl.exe63⤵PID:412
-
C:\Windows\SysWOW64\Hhlehacp.exeC:\Windows\system32\Hhlehacp.exe64⤵PID:8064
-
C:\Windows\SysWOW64\Hofmdl32.exeC:\Windows\system32\Hofmdl32.exe65⤵PID:8032
-
C:\Windows\SysWOW64\Hfpeafai.exeC:\Windows\system32\Hfpeafai.exe66⤵PID:8084
-
C:\Windows\SysWOW64\Hljnnp32.exeC:\Windows\system32\Hljnnp32.exe67⤵PID:8128
-
C:\Windows\SysWOW64\Iohjjk32.exeC:\Windows\system32\Iohjjk32.exe68⤵PID:7004
-
C:\Windows\SysWOW64\Igpbkiil.exeC:\Windows\system32\Igpbkiil.exe69⤵PID:5860
-
C:\Windows\SysWOW64\Ihqoca32.exeC:\Windows\system32\Ihqoca32.exe70⤵PID:6388
-
C:\Windows\SysWOW64\Illkcpgc.exeC:\Windows\system32\Illkcpgc.exe71⤵PID:5796
-
C:\Windows\SysWOW64\Iokgpkfg.exeC:\Windows\system32\Iokgpkfg.exe72⤵PID:384
-
C:\Windows\SysWOW64\Ifdole32.exeC:\Windows\system32\Ifdole32.exe73⤵PID:1804
-
C:\Windows\SysWOW64\Imogioeq.exeC:\Windows\system32\Imogioeq.exe74⤵PID:1640
-
C:\Windows\SysWOW64\Iomcekdd.exeC:\Windows\system32\Iomcekdd.exe75⤵PID:4392
-
C:\Windows\SysWOW64\Igdkfh32.exeC:\Windows\system32\Igdkfh32.exe76⤵PID:4692
-
C:\Windows\SysWOW64\Ijbhbc32.exeC:\Windows\system32\Ijbhbc32.exe77⤵PID:248
-
C:\Windows\SysWOW64\Icklkijk.exeC:\Windows\system32\Icklkijk.exe78⤵PID:3000
-
C:\Windows\SysWOW64\Ijedhc32.exeC:\Windows\system32\Ijedhc32.exe79⤵PID:664
-
C:\Windows\SysWOW64\Imcqdo32.exeC:\Windows\system32\Imcqdo32.exe80⤵PID:3276
-
C:\Windows\SysWOW64\Iflemdgl.exeC:\Windows\system32\Iflemdgl.exe81⤵PID:6112
-
C:\Windows\SysWOW64\Iijaip32.exeC:\Windows\system32\Iijaip32.exe82⤵PID:4804
-
C:\Windows\SysWOW64\Jjincbnb.exeC:\Windows\system32\Jjincbnb.exe83⤵PID:1552
-
C:\Windows\SysWOW64\Jqcfpm32.exeC:\Windows\system32\Jqcfpm32.exe84⤵PID:2852
-
C:\Windows\SysWOW64\Jfpohc32.exeC:\Windows\system32\Jfpohc32.exe85⤵PID:3132
-
C:\Windows\SysWOW64\Jmjgen32.exeC:\Windows\system32\Jmjgen32.exe86⤵PID:6248
-
C:\Windows\SysWOW64\Joicai32.exeC:\Windows\system32\Joicai32.exe87⤵PID:8952
-
C:\Windows\SysWOW64\Jmmcjm32.exeC:\Windows\system32\Jmmcjm32.exe88⤵PID:6620
-
C:\Windows\SysWOW64\Jcflggpn.exeC:\Windows\system32\Jcflggpn.exe89⤵PID:3624
-
C:\Windows\SysWOW64\Jfehccoa.exeC:\Windows\system32\Jfehccoa.exe90⤵PID:1456
-
C:\Windows\SysWOW64\Jcihmg32.exeC:\Windows\system32\Jcihmg32.exe91⤵PID:5168
-
C:\Windows\SysWOW64\Jifaen32.exeC:\Windows\system32\Jifaen32.exe92⤵PID:6504
-
C:\Windows\SysWOW64\Kqmifk32.exeC:\Windows\system32\Kqmifk32.exe93⤵PID:9144
-
C:\Windows\SysWOW64\Kggaceda.exeC:\Windows\system32\Kggaceda.exe94⤵PID:9008
-
C:\Windows\SysWOW64\Kfjanb32.exeC:\Windows\system32\Kfjanb32.exe95⤵PID:3108
-
C:\Windows\SysWOW64\Kihnjn32.exeC:\Windows\system32\Kihnjn32.exe96⤵PID:712
-
C:\Windows\SysWOW64\Kqoelkkb.exeC:\Windows\system32\Kqoelkkb.exe97⤵PID:7804
-
C:\Windows\SysWOW64\Kcnbhfje.exeC:\Windows\system32\Kcnbhfje.exe98⤵PID:7576
-
C:\Windows\SysWOW64\Kijjpmhm.exeC:\Windows\system32\Kijjpmhm.exe99⤵PID:4908
-
C:\Windows\SysWOW64\Kaabakio.exeC:\Windows\system32\Kaabakio.exe100⤵PID:5720
-
C:\Windows\SysWOW64\Kpdbmg32.exeC:\Windows\system32\Kpdbmg32.exe101⤵PID:5844
-
C:\Windows\SysWOW64\Kfnkiagf.exeC:\Windows\system32\Kfnkiagf.exe102⤵PID:5164
-
C:\Windows\SysWOW64\Kjjgjp32.exeC:\Windows\system32\Kjjgjp32.exe103⤵PID:5200
-
C:\Windows\SysWOW64\Kadogjgl.exeC:\Windows\system32\Kadogjgl.exe104⤵PID:6672
-
C:\Windows\SysWOW64\Kiodkm32.exeC:\Windows\system32\Kiodkm32.exe105⤵PID:8196
-
C:\Windows\SysWOW64\Kafllj32.exeC:\Windows\system32\Kafllj32.exe106⤵PID:8396
-
C:\Windows\SysWOW64\Kcdhhe32.exeC:\Windows\system32\Kcdhhe32.exe107⤵PID:8468
-
C:\Windows\SysWOW64\Kfcdda32.exeC:\Windows\system32\Kfcdda32.exe108⤵PID:8668
-
C:\Windows\SysWOW64\Lmmlakkn.exeC:\Windows\system32\Lmmlakkn.exe109⤵PID:8724
-
C:\Windows\SysWOW64\Ljamko32.exeC:\Windows\system32\Ljamko32.exe110⤵PID:5904
-
C:\Windows\SysWOW64\Lakegiad.exeC:\Windows\system32\Lakegiad.exe111⤵PID:2416
-
C:\Windows\SysWOW64\Lciaceph.exeC:\Windows\system32\Lciaceph.exe112⤵PID:8780
-
C:\Windows\SysWOW64\Lgemdc32.exeC:\Windows\system32\Lgemdc32.exe113⤵PID:1368
-
C:\Windows\SysWOW64\Lppbhf32.exeC:\Windows\system32\Lppbhf32.exe114⤵PID:8356
-
C:\Windows\SysWOW64\Lhgjjcfo.exeC:\Windows\system32\Lhgjjcfo.exe115⤵PID:8608
-
C:\Windows\SysWOW64\Lfjjep32.exeC:\Windows\system32\Lfjjep32.exe116⤵PID:1636
-
C:\Windows\SysWOW64\Lapobi32.exeC:\Windows\system32\Lapobi32.exe117⤵PID:8176
-
C:\Windows\SysWOW64\Lcnkod32.exeC:\Windows\system32\Lcnkod32.exe118⤵PID:844
-
C:\Windows\SysWOW64\Lflgkp32.exeC:\Windows\system32\Lflgkp32.exe119⤵PID:7324
-
C:\Windows\SysWOW64\Likcgk32.exeC:\Windows\system32\Likcgk32.exe120⤵PID:5428
-
C:\Windows\SysWOW64\Lmfogjbc.exeC:\Windows\system32\Lmfogjbc.exe121⤵PID:1300
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-