c7e0b5d2f1fc049601bab9697108bb03bf9b8643a7d741f4cd6332931cf0457c

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 20 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "Smilos"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

System Binary Proxy Execution: Rundll32 1 TTPs 1 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
2532	rundll32.exe

Drops desktop.ini file(s) 54 IoCs

description	ioc	Process
File opened for modification	C:\Users\Smilos\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Favorites\Links for United States\desktop.ini	mctadmin.exe
File opened for modification	C:\Users\Smilos\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Contacts\desktop.ini	WinMail.exe
File created	C:\Users\Smilos\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Smilos\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-3290804112-2823094203-3137964600-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Smilos\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Smilos\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Smilos\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Smilos\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Smilos\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\Smilos\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\Smilos\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.INI	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.DAT	rundll32.exe
File opened for modification	C:\Program Files\Uninstall Information\mshtml.Install\mshtml.Install.INI	rundll32.exe
File created	C:\Program Files (x86)\Internet Explorer\Signup\TMP4352$.TMP	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.INI	ie4uinit.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Explorer.EXE
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\LinksBar\LinksFolderMigrate = b07ff9000544db01	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\InternetRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Anchor Underline = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Settings\Background Color = "192,192,192"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\18\IEPropFontName = "Kartika"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\18\IEFixedFontName = "Kartika"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\20\IEFixedFontName = "DokChampa"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\SOFTWARE\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\33\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\SQM	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\DisableScriptDebuggerIE = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Play_Animations = "yes"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\BrowserEmulation\CVListTTL = "0"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\16	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\27\IEPropFontName = "Nyala"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\17	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\38\IEFixedFontName = "MV Boli"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\IETld	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\LowRegistry	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\5	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEPropFontName = "Times New Roman"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEPropFontName = "Plantagenet Cherokee"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Display Inline Images = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\15\IEPropFontName = "Vijaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\22\IEFixedFontName = "Sylfaen"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\27\IEFixedFontName = "Nyala"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\37\IEPropFontName = "Khmer UI"	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Document Windows\height = 00000000	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Play_Background_Sounds = "yes"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\12\IEFixedFontName = "Raavi"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\15	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\27	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Desktop\General\WallpaperSource = "C:\\Windows\\web\\wallpaper\\Windows\\img0.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\32\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\38\IEPropFontName = "MV Boli"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\SQM\InstallDate = "1733066621"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Desktop	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEFixedFontName = "Courier New"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\16\IEPropFontName = "Vani"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\17\IEPropFontName = "Tunga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch	mctadmin.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\34	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\34\IEPropFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\34\IEFixedFontName = "Iskoola Pota"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Save_Session_History_On_Exit = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\10\IEPropFontName = "Mangal"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\20\IEPropFontName = "DokChampa"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\26	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\33	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\32	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\36\IEFixedFontName = "Myanmar Text"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\TypedURLs\url1 = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\13	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\International\Scripts\19\IEFixedFontName = "Cordia New"	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.avi	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mid	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wms\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-asf\CLSID = "{cd3afa8f-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp4\OpenWithProgIds\WMP11.AssocFile.MP4 = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-aiff	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-wav\CLSID = "{cd3afa7b-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DVD\DefaultIcon	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmd	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wms	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.mpa	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.wma	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.snd	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI\PreferExecuteOnMismatch = "1"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.MPEG	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/mp3	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/wav\CLSID = "{cd3afa7b-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax\Extension = ".wax"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.AVI	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-wav\Extension = ".wav"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/vnd.dlna.adts	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\wmplayer.exe\SupportedTypes\.aifc	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M4A\PreferExecuteOnMismatch = "1"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/avi\CLSID = "{cd3afa88-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avi\MP2.Last = "Custom"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2t\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shell\Enqueue\NeverDefault	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.asx\OpenWithProgIds\WMP11.AssocFile.ASX = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.midi\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/basic\CLSID = "{cd3afa73-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/wav\Extension = ".wav"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.aiff\OpenWithProgIds	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m1v\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-ms-wax\Extension = ".wax"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/3gpp\CLSID = "{cd3afa97-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.wmz	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m3u\OpenWithProgIds\WMP11.AssocFile.m3u = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wax\ = "WMP11.AssocFile.WAX"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.m2v	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WAX	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp2v\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wav\MP2.Last = "Custom"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl\Extension = ".wpl"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/midi	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.aifc\OpenWithProgIds\WMP11.AssocFile.AIFF = "0"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.WMD	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.ts\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
824	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 47 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2936	LogonUI.exe
Token: SeSecurityPrivilege	2852	winlogon.exe
Token: SeBackupPrivilege	2852	winlogon.exe
Token: SeSecurityPrivilege	2852	winlogon.exe
Token: SeTcbPrivilege	2852	winlogon.exe
Token: SeSecurityPrivilege	2852	winlogon.exe
Token: SeBackupPrivilege	2852	winlogon.exe
Token: SeSecurityPrivilege	2852	winlogon.exe
Token: SeManageVolumePrivilege	1436	WinMail.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	1296	ie4uinit.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeRestorePrivilege	2532	rundll32.exe
Token: SeManageVolumePrivilege	1904	WinMail.exe
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE
Token: SeShutdownPrivilege	824	Explorer.EXE

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
2948	rundll32.exe
2948	rundll32.exe
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE

Suspicious use of SendNotifyMessage 29 IoCs

pid	Process
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE
824	Explorer.EXE

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1436	WinMail.exe
1904	WinMail.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2852 wrote to memory of 2936	2852	winlogon.exe	38
PID 2852 wrote to memory of 2936	2852	winlogon.exe	38
PID 2852 wrote to memory of 2936	2852	winlogon.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2936	2396	csrss.exe	38
PID 2396 wrote to memory of 2824	2396	csrss.exe	41
PID 2396 wrote to memory of 2824	2396	csrss.exe	41
PID 2852 wrote to memory of 2824	2852	winlogon.exe	41
PID 2852 wrote to memory of 2824	2852	winlogon.exe	41
PID 2852 wrote to memory of 2824	2852	winlogon.exe	41
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2824 wrote to memory of 824	2824	userinit.exe	43
PID 2824 wrote to memory of 824	2824	userinit.exe	43
PID 2824 wrote to memory of 824	2824	userinit.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 824	2396	csrss.exe	43
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 824 wrote to memory of 1072	824	Explorer.EXE	44
PID 824 wrote to memory of 1072	824	Explorer.EXE	44
PID 824 wrote to memory of 1072	824	Explorer.EXE	44
PID 824 wrote to memory of 1072	824	Explorer.EXE	44
PID 824 wrote to memory of 1072	824	Explorer.EXE	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 676	2396	csrss.exe	45
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 1072	2396	csrss.exe	44
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 824 wrote to memory of 2412	824	Explorer.EXE	46
PID 824 wrote to memory of 2412	824	Explorer.EXE	46
PID 824 wrote to memory of 2412	824	Explorer.EXE	46
PID 824 wrote to memory of 2412	824	Explorer.EXE	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 2412	2396	csrss.exe	46
PID 2396 wrote to memory of 1436	2396	csrss.exe	47
PID 2396 wrote to memory of 1436	2396	csrss.exe	47
PID 2396 wrote to memory of 1436	2396	csrss.exe	47
PID 2396 wrote to memory of 1436	2396	csrss.exe	47
PID 2412 wrote to memory of 1436	2412	WinMail.exe	47
PID 2412 wrote to memory of 1436	2412	WinMail.exe	47
PID 2412 wrote to memory of 1436	2412	WinMail.exe	47

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\img12.jpg
1⤵
- Suspicious use of FindShellTrayWindow
PID:2948

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2148

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2324

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1648

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2936
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:1072
  - - C:\Program Files (x86)\Windows Mail\WinMail.exe
      "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2412
    - - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
        5⤵
        Drops desktop.ini file(s)
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1436
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      Modifies Internet Explorer settings
      Modifies registry class
      PID:1700
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:1264
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
      4⤵
      System Location Discovery: System Language Discovery
      PID:2272
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -UserConfig
      4⤵
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of AdjustPrivilegeToken
      PID:1296
    - - C:\Windows\System32\ie4uinit.exe
        
        C:\Windows\System32\ie4uinit.exe -ClearIconCache
        5⤵
        
        PID:1704
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
        5⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Program Files directory
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2532
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
        5⤵
        
        PID:2548
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:2832
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:532
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:1672
  - - C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1904
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      Modifies Internet Explorer settings
      Modifies registry class
      PID:372
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:2716
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
      4⤵
      PID:2496
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
      4⤵
      PID:952
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4d7688,0x13f4d7698,0x13f4d76a8
        5⤵
        
        PID:1464
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:988
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4d7688,0x13f4d7698,0x13f4d76a8
        6⤵
        
        PID:2088
  - - C:\Windows\System32\foda5r.exe
      "C:\Windows\System32\foda5r.exe"
      4⤵
      PID:2060
  - - C:\Program Files\Windows Sidebar\sidebar.exe
      "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
      4⤵
      PID:2052
  - - C:\Windows\SysWOW64\runonce.exe
      C:\Windows\SysWOW64\runonce.exe /Run6432
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:3000
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1564
  - - C:\Windows\System32\mctadmin.exe
      "C:\Windows\System32\mctadmin.exe"
      4⤵
      Drops desktop.ini file(s)
      Modifies Internet Explorer settings
      PID:2412

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1576

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:676

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:1476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery