hxxps://gofile[.]io/d/YHZWCx

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSP\ImagePath = "system32\\drivers\\avgSP.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRvrt\ImagePath = "system32\\drivers\\avgRvrt.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgKbd\ImagePath = "system32\\drivers\\avgKbd.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRdr\ImagePath = "system32\\drivers\\avgRdr2.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSnx\ImagePath = "system32\\drivers\\avgSnx.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgNetHub\ImagePath = "system32\\drivers\\avgNetHub.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgStm\ImagePath = "system32\\drivers\\avgStm.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsdriver\ImagePath = "system32\\drivers\\avgbidsdriver.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSP\ImagePath = "system32\\drivers\\avgSP.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArPot\ImagePath = "system32\\drivers\\avgArPot.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsh\ImagePath = "system32\\drivers\\avgbidsh.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArPot\ImagePath = "system32\\drivers\\avgArPot.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbuniv\ImagePath = "system32\\drivers\\avgbuniv.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgVmm\ImagePath = "system32\\drivers\\avgVmm.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsh\ImagePath = "system32\\drivers\\avgbidsh.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbIDSAgent\ImagePath = "\"C:\\Program Files\\AVG\\Antivirus\\aswidsagent.exe\""	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgNetHub\ImagePath = "system32\\drivers\\avgNetHub.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRvrt\ImagePath = "system32\\drivers\\avgRvrt.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbuniv\ImagePath = "system32\\drivers\\avgbuniv.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgStm\ImagePath = "system32\\drivers\\avgStm.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgRdr\ImagePath = "system32\\drivers\\avgRdr2.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgMonFlt\ImagePath = "system32\\drivers\\avgMonFlt.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArDisk\ImagePath = "system32\\drivers\\avgArDisk.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgElam\ImagePath = "system32\\drivers\\avgElam.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgVmm\ImagePath = "system32\\drivers\\avgVmm.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgbidsdriver\ImagePath = "system32\\drivers\\avgbidsdriver.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgKbd\ImagePath = "system32\\drivers\\avgKbd.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AVG Antivirus\ImagePath = "\"C:\\Program Files\\AVG\\Antivirus\\AVGSvc.exe\" /runassvc"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgArDisk\ImagePath = "system32\\drivers\\avgArDisk.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgElam\ImagePath = "system32\\drivers\\avgElam.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgSnx\ImagePath = "system32\\drivers\\avgSnx.sys"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avgMonFlt\ImagePath = "system32\\drivers\\avgMonFlt.sys"	icarus.exe

Uses Session Manager for persistence 2 TTPs 8 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000000000	icarus.exe

A potential corporate email address has been identified in the URL: 67C716D751E567F70A490D4C@AdobeOrg
phishing
Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 51 IoCs

pid	Process
4744	avg_antivirus_free_setup.exe
4492	avg_antivirus_free_online_setup.exe
5248	icarus.exe
2828	icarus_ui.exe
1032	icarus.exe
1184	icarus.exe
4716	engsup.exe
932	SetupInf.exe
2968	SetupInf.exe
1584	SetupInf.exe
3368	SetupInf.exe
5856	SetupInf.exe
1504	SetupInf.exe
5200	AvEmUpdate.exe
7068	AvEmUpdate.exe
2072	RegSvr.exe
7584	RegSvr.exe
7652	SetupInf.exe
7704	wsc_proxy.exe
7764	avDump.exe
4388	afwServ.exe
4740	afwServ.exe
8184	afwServ.exe
4636	AVGUI.exe
4620	overseer.exe
8292	engsup.exe
8380	icarus.exe
6524	icarus.exe
6500	icarus.exe
2896	icarus_ui.exe
6952	engsup.exe
668	SetupInf.exe
3228	SetupInf.exe
6000	SetupInf.exe
4260	SetupInf.exe
8972	SetupInf.exe
2016	SetupInf.exe
7092	AvEmUpdate.exe
6732	AvEmUpdate.exe
2268	AvEmUpdate.exe
9012	AvEmUpdate.exe
6256	RegSvr.exe
6452	RegSvr.exe
3060	RegSvr.exe
7112	RegSvr.exe
7288	SetupInf.exe
3216	wsc_proxy.exe
8808	avDump.exe
5336	afwServ.exe
6684	overseer.exe
6728	AvDump.exe

Impair Defenses: Safe Mode Boot 1 TTPs 4 IoCs

defense_evasion

Safe Mode Boot

T1562.009

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\avgSP.sys	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\avgSP.sys\ = "Driver"	icarus.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\avgSP.sys	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\avgSP.sys\ = "Driver"	icarus.exe

Loads dropped DLL 64 IoCs

pid	Process
4744	avg_antivirus_free_setup.exe
4492	avg_antivirus_free_online_setup.exe
1032	icarus.exe
1184	icarus.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
4716	engsup.exe
7068	AvEmUpdate.exe
7068	AvEmUpdate.exe
7068	AvEmUpdate.exe
7068	AvEmUpdate.exe
2072	RegSvr.exe
7584	RegSvr.exe
7704	wsc_proxy.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4388	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe
4740	afwServ.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\Provider\Av\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	icarus.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\SECURITY CENTER\PROVIDER\AV\{4FC75CA5-1654-5411-7CFB-1893D506BCF4}	icarus.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGUI.exe = "\"C:\\Program Files\\AVG\\Antivirus\\AvLaunch.exe\" /gui"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\AVGUI.exe = "\"C:\\Program Files\\AVG\\Antivirus\\AvLaunch.exe\" /gui"	icarus.exe

Checks for any installed AV software in registry 1 TTPs 42 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	chrome.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	chrome.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	RegSvr.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast\properties	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	afwServ.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	afwServ.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	afwServ.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AVGUI.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	icarus.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Software\Avira\Antivirus	engsup.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Software\AVAST Software\Avast	afwServ.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Writes to the Master Boot Record (MBR) 1 TTPs 14 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	overseer.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	AVGUI.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	AvEmUpdate.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_online_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	overseer.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\avgBoot.exe	icarus.exe
File opened for modification	C:\Windows\system32\avgBoot.exe.icarus.backup.1736285270	icarus.exe
File created	C:\Windows\system32\icarus_rvrt.exe	icarus.exe
File opened for modification	C:\Windows\system32\icarus_rvrt.exe	icarus.exe
File opened for modification	C:\Windows\system32\avgBoot.exe	icarus.exe
File created	C:\Windows\system32\avgBoot.exe	icarus.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	engsup.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AVG\Antivirus\serialization.dll.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\AvVps\db_mx4.nmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll	engsup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Licenses\protobuf.txt.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\asw47ea95aeca1f043a.tmp	icarus.exe
File opened for modification	C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-116dfdee-a2ef-4961-8dd4-d93f70855b9a\bug_report.exe	icarus.exe
File created	C:\Program Files\AVG\Antivirus\task_performance_logger.dll.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswcomm.dll.ipending.54d68173.lzma	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswAv.dll	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\locales\pt-PT.pak.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\AvVps\db_dns.sig.ipending.6e3e2e1f.lzma	icarus.exe
File opened for modification	C:\Program Files\AVG\AvVps\db_symtrnl.dat	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\avg.local_vc142.crt\api-ms-win-core-console-l1-2-0.dll	engsup.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw399239a6b183477f.tmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Setup\9e5fb53c-220e-48f5-9f5f-1144b700f956\update.xml	AvEmUpdate.exe
File created	C:\Program Files\AVG\Antivirus\module_lifetime.dll.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\locales\am.pak	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\25010704\asw9d8b4179ee895b10.tmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\svgInline.svg.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\BreachGuardSdk.dll	icarus.exe
File opened for modification	C:\Program Files\AVG\AvVps\db_js.sig.ipending.6e3e2e1f	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\aswCmnIS.dll.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-errorhandling-l1-1-0.dll.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Inf\x64\avgVmm.sys.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\updatefile.json.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\AVGUI.exe.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\su_controller.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\asw5b068952ff7fe8ae.tmp	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Inf\x64\avgArPot.sys.ipending.54d68173	icarus.exe
File created	C:\Program Files\Common Files\AVG\Icarus\avg-av\product-info.xml	icarus.exe
File opened for modification	C:\Program Files\AVG\AvVps\certs.map	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw5dc6fddeba6c3ea6.tmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\cef.txt.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswntsqlite.dll.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\lt.pak.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\zh-TW.pak.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\RescueDisk\wxmsw315u_core_vc.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\AvBugReport.exe.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\locales\ar.pak	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-util-l1-1-0.dll.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-pt_BR.json.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\gui_resources\default_av\svelteComponents.js.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\25010704\aswb16cdd063c0b15bc.tmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\su_common.dll.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\ar.pak.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\myLicenses.js.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\xxHash.txt.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ms.json.ipending.54d68173	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\CommonRes.dll	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\gui_resources\default_av\sensitiveData.js	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\aswfcc129b6c84771e3.tmp	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\defs\25010704\db_sn.map	engsup.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\core.js.ipending.54d68173.lzma	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-multibyte-l1-1-0.dll	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\aswEngLdr.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\OobeUtil.exe.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswPropertyAv.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\1033\avg.local_vc142.crt\asw2ae187b0981ce921.tmp	icarus.exe
File opened for modification	C:\Program Files\AVG\Antivirus\Inf\x64\avgBoot.exe	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.54d68173.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-file-l1-1-0.dll.ipending.54d68173	icarus.exe
File created	C:\Program Files\AVG\Antivirus\defs\25010704\avg.local_vc142.crt\api-ms-win-core-rtlsupport-l1-1-0.dll	engsup.exe

Drops file in Windows directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	chrome.exe
File opened for modification	C:\Windows\ELAMBKUP\asw0ab73138a5f63a60.tmp	icarus.exe
File created	C:\Windows\ELAMBKUP\asw0ab73138a5f63a60.tmp	icarus.exe
File opened for modification	C:\Windows\TEMP	icarus.exe
File opened for modification	C:\Windows\TEMP	icarus.exe
File created	C:\Windows\ELAMBKUP\aswebea4597d57573c4.tmp	icarus.exe
File opened for modification	C:\Windows\ELAMBKUP\avgElam.sys	icarus.exe
File opened for modification	C:\Windows\TEMP	icarus.exe
File opened for modification	C:\Windows\ELAMBKUP\aswebea4597d57573c4.tmp	icarus.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Embeds OpenSSL 2 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x001900000002b015-3033.dat	embeds_openssl
behavioral1/files/0x001a00000002ad5b-4059.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_online_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegSvr.exe

Checks SCSI registry key(s) 3 TTPs 16 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	icarus.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	icarus.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	icarus.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	wsc_proxy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	RegSvr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	AvEmUpdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	engsup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AvEmUpdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	SetupInf.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	afwServ.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AVGUI.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	engsup.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	SetupInf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	RegSvr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	wsc_proxy.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	SetupInf.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\EXTENSION VALIDATION\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Extension Validation\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe

Modifies data under HKEY_USERS 17 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133807587565363414"	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365268"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "209"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4290799360"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292114432"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365268"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile\EditFlags = "65536"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\ = "AVG"	icarus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\AvgPersistentStorage\IcarusEnabled = "1"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile	icarus.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1435FAE-811C-4D50-94EC-A02A259992D5}\ = "AVG IExtensionValidation implementation"	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\BrowserFlags = "8"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAM6rq2CyaQE++ahN4d+zRlAQAAAACAAAAAAAQZgAAAAEAACAAAABoX/yoiMe0DFrhNdF2Ro4LSdQTIOXhtG80J1HfBd30vAAAAAAOgAAAAAIAACAAAADqg2QGIqr58p3kXNg80MUzHGfWwy4JtUYR4u+M1JDVOzAAAAD2FVhaDAGTHkafjW7t/Md4EE42pRQN6ZaYHPldBgUx3QCbGDpc70v0XRzDi6QqP49AAAAAAYU0GJ2c7cZZCdXtpLCWhKV3iYKQdEdJ+pWfLfpXyKHel1/AgbI5tlaFNIyQWQ31ILV+Z0b0+Ju4VujMwoVmZA=="	avg_antivirus_free_online_setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVG\ShellEx	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ThreadingModel = "Apartment"	icarus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\BrowserFlags = "8"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\URL Protocol	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVG\ShellEx\ContextMenuHandlers	icarus.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\EditFlags = "65536"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "65F115A51CCCDBF623206AEDE3B3D8A4"	avg_antivirus_free_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex\ContextMenuHandlers\AVG\ = "{472083B1-C522-11CF-8763-00608CC02F24}"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\AVG\\Antivirus\\x86\\ashShell.dll"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\InProcServer32\ = "C:\\Program Files\\AVG\\Antivirus\\ashShell.dll"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\ = "AVG soundpack file"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avgconfig\ = "avgconfigfile"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\ = "AVG config file"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgthemefile\shell\open\command	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgthemefile	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile\shell\open\command\ = "\"C:\\Program Files\\AVG\\Antivirus\\aswChLic.exe\" \"%1\""	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avgconfig\ = "avgconfigfile"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgthemefile\shell	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\ = "AVG"	icarus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\BrowserFlags = "8"	icarus.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}\InprocServer32	RegSvr.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\shell\open\command	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\AVG\ = "{472083B1-C522-11CF-8763-00608CC02F24}"	icarus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avglicfile\EditFlags = "65536"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\shell\ = "open"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\ = "AVG AntiVirus Free"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\shellex	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avgtheme\Content Type = "application/avg-theme"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1435FAE-811C-4D50-94EC-A02A259992D5}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\x86\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\AVGUI.exe	icarus.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgconfigfile\EditFlags = "65536"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\DefaultIcon	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}	icarus.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C52A311F-4B4E-4C5D-80A0-31F0DDE260AB}\InprocServer32	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile\shell	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\shell	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avglic\Content Type = "application/avg-license"	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\avgsoundsfile	icarus.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B1435FAE-811C-4D50-94EC-A02A259992D5}	RegSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B1435FAE-811C-4D50-94EC-A02A259992D5}\InprocServer32\ = "C:\\Program Files\\AVG\\Antivirus\\aswAMSI.dll"	RegSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.avglic	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.avgtheme\ = "avgthemefile"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\avgav\shell\ = "open"	icarus.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{472083B1-C522-11CF-8763-00608CC02F24}\ = "AVG"	icarus.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
2828	icarus_ui.exe
2828	icarus_ui.exe
7764	avDump.exe
7764	avDump.exe
7252	chrome.exe
7252	chrome.exe
7252	chrome.exe
7252	chrome.exe

Suspicious behavior: LoadsDriver 54 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeRestorePrivilege	5248	icarus.exe
Token: SeTakeOwnershipPrivilege	5248	icarus.exe
Token: SeRestorePrivilege	5248	icarus.exe
Token: SeTakeOwnershipPrivilege	5248	icarus.exe
Token: SeRestorePrivilege	5248	icarus.exe
Token: SeTakeOwnershipPrivilege	5248	icarus.exe
Token: SeRestorePrivilege	5248	icarus.exe
Token: SeTakeOwnershipPrivilege	5248	icarus.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeDebugPrivilege	5248	icarus.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeDebugPrivilege	2828	icarus_ui.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeShutdownPrivilege	3220	chrome.exe
Token: SeCreatePagefilePrivilege	3220	chrome.exe
Token: SeRestorePrivilege	1184	icarus.exe
Token: SeTakeOwnershipPrivilege	1184	icarus.exe

Suspicious use of FindShellTrayWindow 39 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
4492	avg_antivirus_free_online_setup.exe
2828	icarus_ui.exe
4636	AVGUI.exe
4636	AVGUI.exe
4636	AVGUI.exe

Suspicious use of SendNotifyMessage 15 IoCs

pid	Process
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
3220	chrome.exe
4636	AVGUI.exe
4636	AVGUI.exe
4636	AVGUI.exe

Suspicious use of SetWindowsHookEx 25 IoCs

pid	Process
4744	avg_antivirus_free_setup.exe
4492	avg_antivirus_free_online_setup.exe
5248	icarus.exe
2828	icarus_ui.exe
2828	icarus_ui.exe
1184	icarus.exe
1032	icarus.exe
4716	engsup.exe
932	SetupInf.exe
2968	SetupInf.exe
1584	SetupInf.exe
3368	SetupInf.exe
5856	SetupInf.exe
1504	SetupInf.exe
5200	AvEmUpdate.exe
7068	AvEmUpdate.exe
2072	RegSvr.exe
7584	RegSvr.exe
7652	SetupInf.exe
7764	avDump.exe
4636	AVGUI.exe
4620	overseer.exe
8292	engsup.exe
6604	PickerHost.exe
5928	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3220 wrote to memory of 844	3220	chrome.exe	79
PID 3220 wrote to memory of 844	3220	chrome.exe	79
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 5708	3220	chrome.exe	80
PID 3220 wrote to memory of 2656	3220	chrome.exe	81
PID 3220 wrote to memory of 2656	3220	chrome.exe	81
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82
PID 3220 wrote to memory of 468	3220	chrome.exe	82

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/YHZWCx
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3d2dcc40,0x7ffc3d2dcc4c,0x7ffc3d2dcc58
  2⤵
  PID:844
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:5708
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1720,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2064 /prefetch:3
  2⤵
  PID:2656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2148,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:8
  2⤵
  PID:468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3096 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4384,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3408,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4640,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3056,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4308,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4464,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4652,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5292,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:5604
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5812,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --no-appcompat-clear --field-trial-handle=5832,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=6176,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4268,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5064
- C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
  "C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4744
- - C:\Windows\Temp\asw.0df2300aa7402fc3\avg_antivirus_free_online_setup.exe
    "C:\Windows\Temp\asw.0df2300aa7402fc3\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_999_999_a9a_m:dlid_FREEGSR-HP /ga_clientid:7bd1d7a4-b295-407f-96b1-2032f7a300a0 /edat_dir:C:\Windows\Temp\asw.0df2300aa7402fc3 /geo:GB
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:4492
  - - C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\common\icarus.exe
      C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\icarus-info.xml /install /cookie:mmm_bav_999_999_a9a_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.0df2300aa7402fc3 /geo:GB /track-guid:7bd1d7a4-b295-407f-96b1-2032f7a300a0 /sssid:4492
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:5248
    - - C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\common\icarus_ui.exe
        
        C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\common\icarus_ui.exe /cookie:mmm_bav_999_999_a9a_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.0df2300aa7402fc3 /geo:GB /track-guid:7bd1d7a4-b295-407f-96b1-2032f7a300a0 /sssid:4492 /er_master:master_ep_7fedd335-0fb5-4377-85c4-e0c8e9dc86f5 /er_ui:ui_ep_655e5876-d62b-43ab-aef0-0e2bc29a6fda
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:2828
    - - C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\avg-av\icarus.exe
        
        C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\avg-av\icarus.exe /cookie:mmm_bav_999_999_a9a_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.0df2300aa7402fc3 /geo:GB /track-guid:7bd1d7a4-b295-407f-96b1-2032f7a300a0 /sssid:4492 /er_master:master_ep_7fedd335-0fb5-4377-85c4-e0c8e9dc86f5 /er_ui:ui_ep_655e5876-d62b-43ab-aef0-0e2bc29a6fda /er_slave:avg-av_slave_ep_029387f8-abb2-4f9f-bd79-214c93ed73eb /slave:avg-av
        5⤵
        Drops file in Drivers directory
        Sets service image path in registry
        Uses Session Manager for persistence
        Executes dropped EXE
        Impair Defenses: Safe Mode Boot
        Loads dropped DLL
        Windows security modification
        Adds Run key to start application
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Drops file in Program Files directory
        Drops file in Windows directory
        Checks SCSI registry key(s)
        Checks processor information in registry
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:1032
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:932
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:1584
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:3368
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5856
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:1504
      - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
        
        "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:5200
      - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
        
        "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:7068
      - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
        
        "C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        System Location Discovery: System Language Discovery
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:2072
      - C:\Program Files\AVG\Antivirus\RegSvr.exe
        
        "C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Checks processor information in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious use of SetWindowsHookEx
        
        PID:7584
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B699
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:7652
      - C:\Program Files\AVG\Antivirus\wsc_proxy.exe
        
        "C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Checks processor information in registry
        
        PID:7704
        
        C:\Program Files\AVG\Antivirus\avDump.exe
        
        "C:\Program Files\AVG\Antivirus\avDump.exe" --pid 7704 --exception_ptr 000000870C94E6D0 --thread_id 7712 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp311545064113921883i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 60
        7⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of SetWindowsHookEx
        
        PID:7764
      - C:\Program Files\Common Files\AVG\Overseer\overseer.exe
        
        "C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
        6⤵
        Executes dropped EXE
        Writes to the Master Boot Record (MBR)
        Suspicious use of SetWindowsHookEx
        
        PID:4620
      - C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe
        
        "C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe" /avg /get_latest_ga_client_id /get_latest_landingpageid_cookie /get_latest_pagedownloadid_cookie
        6⤵
        Executes dropped EXE
        Checks for any installed AV software in registry
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:8292
    - - C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\avg-av-vps\icarus.exe
        
        C:\Windows\Temp\asw-dc885d44-93cc-40d2-b1a6-9a677d32680c\avg-av-vps\icarus.exe /cookie:mmm_bav_999_999_a9a_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.0df2300aa7402fc3 /geo:GB /track-guid:7bd1d7a4-b295-407f-96b1-2032f7a300a0 /sssid:4492 /er_master:master_ep_7fedd335-0fb5-4377-85c4-e0c8e9dc86f5 /er_ui:ui_ep_655e5876-d62b-43ab-aef0-0e2bc29a6fda /er_slave:avg-av-vps_slave_ep_6c208c2c-80a1-4159-8636-192dc6d0878c /slave:avg-av-vps
        5⤵
        Uses Session Manager for persistence
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in Program Files directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:1184
      - C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe
        
        "C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe" /prepare_definitions_folder
        6⤵
        Drops file in Drivers directory
        Executes dropped EXE
        Loads dropped DLL
        Checks for any installed AV software in registry
        Drops file in System32 directory
        Drops file in Program Files directory
        Suspicious use of SetWindowsHookEx
        
        PID:4716
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4900,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Checks for any installed AV software in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:7252
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --field-trial-handle=3696,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:7176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --field-trial-handle=4760,i,1984559302148930070,9562733283725237670,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5632

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:1368

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:2420

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4388

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:4740

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:8184

C:\Program Files\AVG\Antivirus\AVGUI.exe
"C:\Program Files\AVG\Antivirus\AVGUI.exe" /welcome
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4636

C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe
"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /repair:avg-av /silent /ii_reason:FwSvcRecovery
1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Drops file in Windows directory
- Checks processor information in registry
PID:8380
- C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-116dfdee-a2ef-4961-8dd4-d93f70855b9a\icarus.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-116dfdee-a2ef-4961-8dd4-d93f70855b9a\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_f2d554d5-d937-4484-baf1-39df899bf579 /er_ui:ui_ep_ce3ac804-0c28-4b18-bcb3-d1da55e0dea8 /er_slave:avg-av-vps_slave_ep_4dbd2372-ad5e-4f19-b66d-ad0a5788cbcc /slave:avg-av-vps
  2⤵
  - Uses Session Manager for persistence
  - Executes dropped EXE
  - Writes to the Master Boot Record (MBR)
  - Drops file in Program Files directory
  - Drops file in Windows directory
  PID:6500
- - C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe
    "C:\Program Files\AVG\Antivirus\defs\25010704\engsup.exe" /prepare_definitions_folder
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Drops file in Program Files directory
    - Checks processor information in registry
    PID:6952
- C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-116dfdee-a2ef-4961-8dd4-d93f70855b9a\icarus.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-116dfdee-a2ef-4961-8dd4-d93f70855b9a\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_f2d554d5-d937-4484-baf1-39df899bf579 /er_ui:ui_ep_ce3ac804-0c28-4b18-bcb3-d1da55e0dea8 /er_slave:avg-av_slave_ep_78891db1-1ea2-41ef-93b2-09cba9b3239e /slave:avg-av
  2⤵
  - Sets service image path in registry
  - Uses Session Manager for persistence
  - Executes dropped EXE
  - Impair Defenses: Safe Mode Boot
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies registry class
  PID:6524
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:668
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:3228
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:6000
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    PID:4260
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    PID:8972
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:2016
- - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
    "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    PID:7092
- - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
    "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /updater /reg
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:6732
- - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
    "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Drops file in Program Files directory
    - Checks processor information in registry
    PID:2268
- - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
    "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /updater
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Writes to the Master Boot Record (MBR)
    - Checks processor information in registry
    PID:9012
- - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
    "C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - System Location Discovery: System Language Discovery
    - Modifies Internet Explorer settings
    PID:6256
- - C:\Program Files\AVG\Antivirus\RegSvr.exe
    "C:\Program Files\AVG\Antivirus\RegSvr.exe" /U "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:6452
- - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
    "C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - System Location Discovery: System Language Discovery
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:3060
- - C:\Program Files\AVG\Antivirus\RegSvr.exe
    "C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:7112
- - C:\Program Files\AVG\Antivirus\SetupInf.exe
    "C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B699
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    - Checks processor information in registry
    PID:7288
- - C:\Program Files\AVG\Antivirus\wsc_proxy.exe
    "C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
    3⤵
    - Executes dropped EXE
    - Checks for any installed AV software in registry
    PID:3216
  - - C:\Program Files\AVG\Antivirus\avDump.exe
      "C:\Program Files\AVG\Antivirus\avDump.exe" --pid 3216 --exception_ptr 00000080E31AE770 --thread_id 8188 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp31154507124764770i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 60
      4⤵
      Executes dropped EXE
      PID:8808
- - C:\Program Files\Common Files\AVG\Overseer\overseer.exe
    "C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    PID:6684
- - C:\Program Files\AVG\Antivirus\AvDump.exe
    "C:\Program Files\AVG\Antivirus\AvDump.exe" /unregister
    3⤵
    - Executes dropped EXE
    PID:6728
- C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe" /sbr /eid=9486b6e5-b6ae-4ea5-b5fe-bbf8f81dfd3a
  2⤵
  - Executes dropped EXE
  PID:2896

C:\Windows\System32\PickerHost.exe
C:\Windows\System32\PickerHost.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:6604

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39c4055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5928

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
- Executes dropped EXE
- Checks for any installed AV software in registry
- Checks processor information in registry
PID:5336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Safe Mode Boot

T1562.009

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

Software Discovery

T1518

Security Software Discovery

T1518.001

System Information Discovery