755bd7f1fc6e93c3a69a1125dd74735895bdbac9b7cabad0506195a066bdde42

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	Explorer.EXE

Boot or Logon Autostart Execution: Active Setup 2 TTPs 22 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Locale = "EN"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Version = "12,0,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}\Version = "43,0,0,0"	Explorer.EXE
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\Active Setup\Installed Components	MSAGENT.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Version = "11,0,9600,0"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}\Locale = "*"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Username = "lolipop"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED}\Version = "1,1,1,9"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Version = "6,1,7601,17514"	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{44BBA840-CC51-11CF-AAFA-00AA00B6015C}\Locale = "*"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340}\Locale = "en"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components	Explorer.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6}\Locale = "EN"	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820}	Explorer.EXE
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96}	Explorer.EXE
Key created	\REGISTRY\MACHINE\software\Wow6432Node\microsoft\Active Setup\Installed Components	tv_enua.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	regsvr32.exe

Executes dropped EXE 7 IoCs

pid	Process
2268	MSAGENT.EXE
700	tv_enua.exe
864	AgentSvr.exe
1132	BonziBDY_4.EXE
664	AgentSvr.exe
2128	Uninstall.exe
1484	Uninstall.exe

Loads dropped DLL 60 IoCs

pid	Process
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
2092	BonziBuddy432.exe
1684	cmd.exe
1684	cmd.exe
1684	cmd.exe
1684	cmd.exe
2268	MSAGENT.EXE
700	tv_enua.exe
2268	MSAGENT.EXE
2268	MSAGENT.EXE
700	tv_enua.exe
700	tv_enua.exe
700	tv_enua.exe
3016	regsvr32.exe
3016	regsvr32.exe
2356	regsvr32.exe
2268	MSAGENT.EXE
2820	regsvr32.exe
2824	regsvr32.exe
2876	regsvr32.exe
2636	regsvr32.exe
692	regsvr32.exe
2108	regsvr32.exe
1920	regsvr32.exe
2268	MSAGENT.EXE
2268	MSAGENT.EXE
864	AgentSvr.exe
864	AgentSvr.exe
864	AgentSvr.exe
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
664	AgentSvr.exe
664	AgentSvr.exe
664	AgentSvr.exe
664	AgentSvr.exe
664	AgentSvr.exe
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1760	DllHost.exe
2128	Uninstall.exe

System Binary Proxy Execution: Rundll32 1 TTPs 2 IoCs

Abuse Rundll32 to proxy execution of malicious code.

defense_evasion

Rundll32

T1218.011

pid	Process
1128	rundll32.exe
2364	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\tv_enua = "RunDll32 advpack.dll,LaunchINFSection C:\\Windows\\INF\\tv_enua.inf, RemoveCabinet"	tv_enua.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 54 IoCs

description	ioc	Process
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\lolipop\Pictures\desktop.ini	regsvr32.exe
File created	C:\Users\lolipop\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	WinMail.exe
File opened for modification	C:\Users\lolipop\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\lolipop\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Contacts\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	Explorer.EXE
File opened for modification	C:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Contacts\desktop.ini	WinMail.exe
File opened for modification	C:\Users\lolipop\Desktop\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Saved Games\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Pictures\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Downloads\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Favorites\Links\desktop.ini	ie4uinit.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Links\desktop.ini	regsvr32.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\lolipop\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	Explorer.EXE
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Videos\desktop.ini	regsvr32.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-1488793075-819845221-1497111674-1001\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Favorites\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Favorites\Links for United States\desktop.ini	mctadmin.exe
File opened for modification	C:\Users\lolipop\Searches\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Music\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\lolipop\Documents\desktop.ini	regsvr32.exe
File opened for modification	C:\Users\Public\desktop.ini	regsvr32.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\A:	unregmp2.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\SET592D.tmp	tv_enua.exe
File created	C:\Windows\SysWOW64\SET592D.tmp	tv_enua.exe
File opened for modification	C:\Windows\SysWOW64\msvcp50.dll	tv_enua.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\lolipop\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Control Panel\Desktop\Wallpaper = "C:\\Users\\lolipop\\AppData\\Roaming\\Microsoft\\Windows\\Themes\\TranscodedWallpaper.jpg"	regsvr32.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\BonziBuddy432\j2.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\SSCALA32.OCX	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\sites.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page10.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page12.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziCheckers.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\p001.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\spchapi.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.vbs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\msvbvm60.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\Readme.txt	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page0.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page5.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page9.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\J001.nbd-SR	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\j3.nbd-SR	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page1.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb005.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Intro2.wav	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\ssa3d30.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\sstabs2.ocx	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\AutoShortcutsMaker.vbs	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\ManualDirPatcher.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\menu.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page3.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page17.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.INI	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page8.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Bonzi's Solitaire.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BG\Bg3.bmp	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\AutoDirPatcher.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Options\fix.bat	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb003.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Internet\page1.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonzi and the Alpha-net\page4.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files\Uninstall Information\IE40.UserAgent\IE40.UserAgent.DAT	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBUDDY_Killer.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Runtimes\spchcpl.exe	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page17.htm	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb001.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page11.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page7.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.DAT	ie4uinit.exe
File opened for modification	C:\Program Files\Uninstall Information\IE UserData NT\IE UserData NT.INI	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Apps.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\empop3.dll	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Reg.nbd	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Polizoof\page13.jpg	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\page0.jpg	BonziBuddy432.exe
File created	C:\Program Files (x86)\BonziBuddy432\Reg.nbd.temp	BonziBDY_4.EXE
File opened for modification	C:\Program Files\Uninstall Information\IE.HKCUZoneInfo\IE.HKCUZoneInfo.DAT	ie4uinit.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb012.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\Books\Bonz and the Treasure Chest\cb014.gif	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY.vbw	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\BonziBDY_35.EXE	BonziBuddy432.exe
File opened for modification	C:\Program Files (x86)\BonziBuddy432\RACREG32.DLL	BonziBuddy432.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\msagent\chars\Bonzi.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D1B.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\help\SET590B.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET6D1A.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D1B.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\SET6D2D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\occache\tv_enua.exe	rundll32.exe
File opened for modification	C:\Windows\Installer\{AC76BA86-7AD7-1033-7B44-A90000000001}\SC_Reader.exe	Explorer.EXE
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\DisplayIcon.ico	Explorer.EXE
File opened for modification	C:\Windows\INF\SET591C.tmp	tv_enua.exe
File created	C:\Windows\msagent\SET6D06.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D1A.tmp	MSAGENT.EXE
File opened for modification	\??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\sc_reader.exe	Explorer.EXE
File opened for modification	C:\Windows\lhsp\help\tv_enua.hlp	tv_enua.exe
File opened for modification	C:\Windows\msagent\SET6D08.tmp	MSAGENT.EXE
File created	C:\Windows\INF\SET6D2D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\setupapi.app.log	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\SET58EA.tmp	tv_enua.exe
File created	C:\Windows\INF\SET591C.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentCtl.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D07.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentDp2.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D08.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D19.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\intl\SET6D3F.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\chars\Peedy.acs	BonziBuddy432.exe
File opened for modification	C:\Windows\fonts\SET591B.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\tv_enua.inf	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentDPv.dll	MSAGENT.EXE
File created	C:\Windows\help\SET6D3E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\SET6D3F.tmp	MSAGENT.EXE
File created	C:\Windows\lhsp\tv\SET58CA.tmp	tv_enua.exe
File opened for modification	C:\Windows\lhsp\tv\tvenuax.dll	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentMPx.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSR.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D2C.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D2C.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\SET6D3E.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\setupapi.app.log	rundll32.exe
File opened for modification	C:\Windows\lhsp\help\SET590B.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\mslwvtts.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D05.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentSvr.exe	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D19.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\AgentAnm.dll	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D40.tmp	MSAGENT.EXE
File created	C:\Windows\fonts\SET591B.tmp	tv_enua.exe
File opened for modification	C:\Windows\INF\setupapi.app.log	ie4uinit.exe
File opened for modification	C:\Windows\lhsp\tv\tv_enua.dll	tv_enua.exe
File created	C:\Windows\lhsp\tv\SET58EA.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgentPsh.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D3D.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D3D.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\lhsp\tv\SET58CA.tmp	tv_enua.exe
File opened for modification	C:\Windows\msagent\AgtCtl15.tlb	MSAGENT.EXE
File opened for modification	C:\Windows\fonts\andmoipa.ttf	tv_enua.exe
File created	C:\Windows\msagent\SET6D05.tmp	MSAGENT.EXE
File created	C:\Windows\msagent\SET6D07.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\INF\agtinst.inf	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\intl\Agt0409.dll	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D06.tmp	MSAGENT.EXE
File opened for modification	C:\Windows\help\Agt0409.hlp	MSAGENT.EXE
File opened for modification	C:\Windows\msagent\SET6D40.tmp	MSAGENT.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBDY_4.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Nls\Language	csrss.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinMail.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IEXPLORE.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSAGENT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	grpconv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Uninstall.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BonziBuddy432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	runonce.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tv_enua.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AgentSvr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCSSync.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Explorer.EXE
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	runonce.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	runonce.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Explorer.EXE

Enumerates system info in registry 2 TTPs 35 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe

Modifies Internet Explorer Protected Mode 1 TTPs 1 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3"	ie4uinit.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\14	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\3\IEPropFontName = "Times New Roman"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\IETld	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\31\IEPropFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\SOFTWARE\Microsoft\Internet Explorer\Services	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Settings\Anchor Color = "0,0,255"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wmx	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\35	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\New Windows\PlaySound = "1"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\11\IEFixedFontName = "Shonar Bangla"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\37	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Setup	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\19	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Main\WindowsSearch	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\New Windows\PopupMgr = "yes"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\29\IEFixedFontName = "Plantagenet Cherokee"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\{CFBFAE00-17A6-11D0-99CB-00C04FD64497}	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\29	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\12	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\SOFTWARE\Microsoft\Internet Explorer\Settings	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\13\IEFixedFontName = "Shruti"	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Desktop\General	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\21\IEFixedFontName = "Microsoft Himalaya"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Settings\Anchor Color Visited = "128,0,128"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\9\IEPropFontName = "Times New Roman"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\20	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Document Windows	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\LowRegistry	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\30\IEPropFontName = "Microsoft Yi Baiti"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\31\IEFixedFontName = "Segoe UI Symbol"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f09530a37067db01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEFixedFontName = "Kalinga"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\15	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\21\IEPropFontName = "Microsoft Himalaya"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\22	ie4uinit.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Main\Do404Search = 01000000	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Main\NoUpdateCheck = "1"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Document Windows\Maximized = "no"	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\23\IEFixedFontName = "GulimChe"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\IntelliForms	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\5	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\38	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Main\Save_Session_History_On_Exit = "no"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wm	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\13\IEPropFontName = "Shruti"	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\28	ie4uinit.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{CD12E7B1-D363-11EF-98BD-527E38F5B48B} = "0"	iexplore.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.wax	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\6	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\10	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\11\IEPropFontName = "Shonar Bangla"	ie4uinit.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Internet Explorer\EmbedExtnToClsidMappings\.midi	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	ie4uinit.exe
Key created	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\9	ie4uinit.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\International\Scripts\14\IEPropFontName = "Kalinga"	ie4uinit.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1001\Software\Microsoft\Internet Explorer\Main\Start Page = "http://go.microsoft.com/fwlink/p/?LinkId=255141"	ie4uinit.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MSComctlLib.TreeCtrl.2	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}\Implemented Categories\{40FC6ED5-2438-11CF-A3DB-080036F12502}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0A45DB49-BD0D-11D2-8D14-00104B9E072A}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{8563FF20-8ECC-11D1-B9B4-00C04FD97575}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{B0913412-3B44-11D1-ACBA-00C04FD97575}\TypeLib\ = "{A7B93C73-7B81-11D0-AC5F-00C04FD97575}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6549F504-C43A-43F3-B8CD-D077AF0427C8}\TypeLib\ = "{F4900F5D-055F-11D4-8F9B-00104BA312D6}"	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BDD1F04B-858B-11D1-B16A-00C0F0283628}\MiscStatus	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B8F2846E-CE36-11D0-AC83-00C04FD97575}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gpp\OpenWithProgIds	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2F5A7562-BDC3-41F8-8122-4A54D2C3C50C}\TypeLib\ = "{29D9184E-BF09-4F13-B356-22841635C733}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8E3867A4-8586-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{00E212A0-E66D-11CD-836C-0000C0C14E92}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{14E27A73-69F0-11CE-9425-0000C0C14E92}\ = "_DYearEvents"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2C247F23-8591-11D1-B16A-00C0F0283628}\TypeLib	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{35053A22-8589-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{065E6FE9-1BF9-11D2-BAE8-00104B9E0792}\MiscStatus	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E91E27A3-C5AE-11D2-8D1B-00104B9E072A}\ = "SSTabPanel Control"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6B976287-3692-11D0-9B8A-0000C0F04C96}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{53FA8D42-2CDD-11D3-9DD0-D3CD4078982A}\ = "_ISkinButtonEvents"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSCheck	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{065E6FDD-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Agent.Control.2	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BonziBUDDY.CCalendarVBPeriods	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSCheck.3\CLSID\ = "{065E6FE3-1BF9-11D2-BAE8-00104B9E0792}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DACB7A39-CC0D-4B85-908B-10D2451761A5}\ProxyStubClsid32	BonziBDY_4.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WMP11.AssocFile.M3U\PreferExecuteOnMismatch = "1"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.3gp	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD9DA662-8594-11D1-B16A-00C0F0283628}\TypeLib\ = "{831FDD16-0C5C-11D2-A9FC-0000F8754DA1}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{F5BE8BD4-7DE6-11D0-91FE-00C04FD701A5}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB64DF2F-88E4-11D0-9E87-00C04FD7081F}\TreatAs	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\application/vnd.ms-wpl	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WTV\MP2.Last = "Custom"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{065E6FDF-1BF9-11D2-BAE8-00104B9E0792}\TypeLib	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B7-8589-11D1-B16A-00C0F0283628}\ProxyStubClsid32	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A7B93C8B-7B81-11D0-AC5F-00C04FD97575}\ = "IAgentPropertySheet"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4900F6A-055F-11D4-8F9B-00104BA312D6}\TypeLib\ = "{F4900F5D-055F-11D4-8F9B-00104BA312D6}"	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/x-mp3	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\audio/vnd.dlna.adts\CLSID = "{cd3afa7d-b84f-48f0-9393-7edc34128127}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinSource\CurVer\ = "ActiveSkin.SkinSource.1"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{66833FE6-8583-11D1-B16A-00C0F0283628}\Implemented Categories\{0DE86A53-2BAA-11CF-A229-00AA003D7352}	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F08DF952-8592-11D1-B16A-00C0F0283628}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{A7B93CA0-7B81-11D0-AC5F-00C04FD97575}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AgentSvr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D7A6D440-8872-11D1-9EC6-00C04FD7081F}\ = "IAgentBalloonEx"	AgentSvr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MIME\Database\Content Type\video/x-ms-wvx	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C4D7E3C7-3C26-4052-A993-71E500EA8C05}\ProgID\ = "ActiveSkin.ComFilters.1"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{E91E27A1-C5AE-11D2-8D1B-00104B9E072A}\TypeLib\ = "{0A45DB48-BD0D-11D2-8D14-00104B9E072A}"	BonziBuddy432.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F5A31F2F-122F-4615-A9B7-90841538EC7C}\VERSION	BonziBDY_4.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{065E6FDF-1BF9-11D2-BAE8-00104B9E0792}\Programmable	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C74190B5-8589-11D1-B16A-00C0F0283628}\TypeLib\Version = "2.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ActiveSkin.SkinForm.1\ = "ActiveSkin.SkinForm Class"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EF6BEC1-E669-11CD-836C-0000C0C14E92}\ = "_DSSMonthEvents"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1EFB6595-857C-11D1-B16A-00C0F0283628}	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{065E6FDD-1BF9-11D2-BAE8-00104B9E0792}\TypeLib\Version = "3.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F5BE8BD9-7DE6-11D0-91FE-00C04FD701A5}\TypeLib\Version = "2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E26DD3CD-B06C-47BA-9766-5F264B858E09}\ = "BonziBUDDY.CCalendarVBPeriod"	BonziBDY_4.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.m4v\OpenWithProgIds\WMP11.AssocFile.MP4 = "0"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\OpenWithProgIds\WMP11.AssocFile.MPEG = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{83C2D7A0-0DE6-11D3-9DCF-9423F1B2561C}\TypeLib\Version = "1.0"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2C247F21-8591-11D1-B16A-00C0F0283628}\ = "IImageList"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{916694A9-8AD6-11D2-B6FD-0060976C699F}\TypeLib\Version = "1.1"	BonziBuddy432.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Threed.SSPanel\ = "SSPanel Control 3.0"	BonziBuddy432.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2112	chrome.exe
2112	chrome.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2356	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	700	tv_enua.exe
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: SeRestorePrivilege	2268	MSAGENT.EXE
Token: 33	664	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	664	AgentSvr.exe
Token: 33	984	SndVol.exe
Token: SeIncBasePriorityPrivilege	984	SndVol.exe
Token: 33	664	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	664	AgentSvr.exe
Token: 33	664	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	664	AgentSvr.exe
Token: 33	664	AgentSvr.exe
Token: SeIncBasePriorityPrivilege	664	AgentSvr.exe
Token: SeShutdownPrivilege	2344	LogonUI.exe
Token: SeSecurityPrivilege	2772	winlogon.exe
Token: SeBackupPrivilege	2772	winlogon.exe
Token: SeSecurityPrivilege	2772	winlogon.exe
Token: SeTcbPrivilege	2772	winlogon.exe
Token: SeSecurityPrivilege	2772	winlogon.exe
Token: SeBackupPrivilege	2772	winlogon.exe
Token: SeSecurityPrivilege	2772	winlogon.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeRestorePrivilege	1128	rundll32.exe
Token: SeManageVolumePrivilege	2088	WinMail.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	1508	ie4uinit.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeRestorePrivilege	2364	rundll32.exe
Token: SeManageVolumePrivilege	2116	WinMail.exe
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE
Token: SeShutdownPrivilege	2356	Explorer.EXE

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
664	AgentSvr.exe
984	SndVol.exe
984	SndVol.exe
664	AgentSvr.exe
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2112	chrome.exe
2112	chrome.exe
2112	chrome.exe
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
664	AgentSvr.exe
984	SndVol.exe
984	SndVol.exe
984	SndVol.exe
984	SndVol.exe
664	AgentSvr.exe
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE
2356	Explorer.EXE

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
1732	iexplore.exe
1732	iexplore.exe
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
2448	IEXPLORE.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
1132	BonziBDY_4.EXE
2088	WinMail.exe
2116	WinMail.exe
2356	Explorer.EXE
2356	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 1684	2092	BonziBuddy432.exe	30
PID 2092 wrote to memory of 1684	2092	BonziBuddy432.exe	30
PID 2092 wrote to memory of 1684	2092	BonziBuddy432.exe	30
PID 2092 wrote to memory of 1684	2092	BonziBuddy432.exe	30
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 2268	1684	cmd.exe	33
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 1684 wrote to memory of 700	1684	cmd.exe	34
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 3016	700	tv_enua.exe	35
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2356	700	tv_enua.exe	36
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 700 wrote to memory of 2556	700	tv_enua.exe	37
PID 2092 wrote to memory of 1732	2092	BonziBuddy432.exe	38
PID 2092 wrote to memory of 1732	2092	BonziBuddy432.exe	38
PID 2092 wrote to memory of 1732	2092	BonziBuddy432.exe	38
PID 2092 wrote to memory of 1732	2092	BonziBuddy432.exe	38
PID 1732 wrote to memory of 2448	1732	iexplore.exe	39
PID 1732 wrote to memory of 2448	1732	iexplore.exe	39
PID 1732 wrote to memory of 2448	1732	iexplore.exe	39
PID 1732 wrote to memory of 2448	1732	iexplore.exe	39
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2820	2268	MSAGENT.EXE	40
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2824	2268	MSAGENT.EXE	41
PID 2268 wrote to memory of 2876	2268	MSAGENT.EXE	42
PID 2268 wrote to memory of 2876	2268	MSAGENT.EXE	42
PID 2268 wrote to memory of 2876	2268	MSAGENT.EXE	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\BonziBuddy432.exe
"C:\Users\Admin\AppData\Local\Temp\BonziBuddy432.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Program Files (x86)\BonziBuddy432\Runtimes\CheckRuntimes.bat" "
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1684
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\MSAGENT.EXE
    MSAGENT.EXE
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2268
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentCtl.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2820
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDPv.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2824
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\mslwvtts.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2876
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentDP2.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentMPx.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:692
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentSR.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:2108
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s "C:\Windows\msagent\AgentPsh.dll"
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:1920
  - - C:\Windows\msagent\AgentSvr.exe
      "C:\Windows\msagent\AgentSvr.exe" /regserver
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:864
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:1720
- - C:\Program Files (x86)\BonziBuddy432\Runtimes\tv_enua.exe
    tv_enua.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in System32 directory
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:700
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tv_enua.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3016
  - - C:\Windows\SysWOW64\regsvr32.exe
      regsvr32 /s C:\Windows\lhsp\tv\tvenuax.dll
      4⤵
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Modifies registry class
      PID:2356
  - - C:\Windows\SysWOW64\grpconv.exe
      grpconv.exe -o
      4⤵
      System Location Discovery: System Language Discovery
      PID:2556
- C:\Program Files\Internet Explorer\iexplore.exe
  "C:\Program Files\Internet Explorer\iexplore.exe" http://bonzibuddy.tk/
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1732
- - C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1732 CREDAT:275457 /prefetch:2
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2448

C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE
"C:\Program Files (x86)\BonziBuddy432\BonziBDY_4.EXE"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1132

C:\Windows\msagent\AgentSvr.exe
C:\Windows\msagent\AgentSvr.exe -Embedding
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:664

C:\Windows\system32\SndVol.exe
SndVol.exe -f 45810841 26073
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:984

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2208

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:848

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1444

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
PID:2856

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2772
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2344
- C:\Windows\system32\userinit.exe
  C:\Windows\system32\userinit.exe
  2⤵
  PID:1628
- - C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    3⤵
    - Modifies visibility of file extensions in Explorer
    - Boot or Logon Autostart Execution: Active Setup
    - Drops desktop.ini file(s)
    - Drops file in Windows directory
    - Checks processor information in registry
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:2356
  - - C:\Windows\system32\runonce.exe
      C:\Windows\system32\runonce.exe /Explorer
      4⤵
      Checks processor information in registry
      PID:2008
    - - C:\Windows\SysWOW64\runonce.exe
        
        C:\Windows\SysWOW64\runonce.exe /RunOnce6432
        5⤵
        System Location Discovery: System Language Discovery
        Checks processor information in registry
        
        PID:2888
      - C:\Windows\SysWOW64\rundll32.exe
        
        "C:\Windows\System32\rundll32.exe" advpack.dll,LaunchINFSection C:\Windows\INF\tv_enua.inf, RemoveCabinet
        6⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1128
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Drops desktop.ini file(s)
      Sets desktop wallpaper using registry
      Modifies Internet Explorer settings
      PID:3008
  - - C:\Program Files (x86)\Windows Mail\WinMail.exe
      "C:\Program Files (x86)\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Drops desktop.ini file(s)
      System Location Discovery: System Language Discovery
      PID:2064
    - - C:\Program Files\Windows Mail\WinMail.exe
        
        "C:\Program Files\Windows Mail\WinMail" OCInstallUserConfigOE
        5⤵
        Drops desktop.ini file(s)
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:2088
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      Modifies Internet Explorer settings
      Modifies registry class
      PID:1008
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:1184
  - - C:\Windows\SysWOW64\rundll32.exe
      "C:\Windows\SysWOW64\rundll32.exe" C:\Windows\SysWOW64\mscories.dll,Install
      4⤵
      System Location Discovery: System Language Discovery
      PID:1188
  - - C:\Windows\System32\ie4uinit.exe
      "C:\Windows\System32\ie4uinit.exe" -UserConfig
      4⤵
      Drops desktop.ini file(s)
      Drops file in Program Files directory
      Drops file in Windows directory
      Modifies Internet Explorer Protected Mode
      Modifies Internet Explorer settings
      Modifies Internet Explorer start page
      Suspicious use of AdjustPrivilegeToken
      PID:1508
    - - C:\Windows\System32\ie4uinit.exe
        
        C:\Windows\System32\ie4uinit.exe -ClearIconCache
        5⤵
        
        PID:1504
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 advpack.dll,LaunchINFSectionEx C:\Windows\system32\ieuinit.inf,Install,,36
        5⤵
        System Binary Proxy Execution: Rundll32
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2364
    - - C:\Windows\System32\rundll32.exe
        
        C:\Windows\System32\rundll32 C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m
        5⤵
        
        PID:1120
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:3036
      - C:\Windows\system32\RunDll32.exe
        
        C:\Windows\system32\RunDll32.exe C:\Windows\system32\migration\WininetPlugin.dll,MigrateCacheForUser /m /0
        6⤵
        
        PID:1516
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:/UserInstall C:\Windows\system32\themeui.dll
      4⤵
      Sets desktop wallpaper using registry
      PID:2008
  - - C:\Program Files\Windows Mail\WinMail.exe
      "C:\Program Files\Windows Mail\WinMail.exe" OCInstallUserConfigOE
      4⤵
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:2116
  - - C:\Windows\System32\unregmp2.exe
      "C:\Windows\System32\unregmp2.exe" /FirstLogon /Shortcuts /RegBrowsers /ResetMUI
      4⤵
      Drops desktop.ini file(s)
      Enumerates connected drives
      Modifies Internet Explorer settings
      Modifies registry class
      PID:904
  - - C:\Windows\System32\regsvr32.exe
      "C:\Windows\System32\regsvr32.exe" /s /n /i:U shell32.dll
      4⤵
      Drops startup file
      Drops desktop.ini file(s)
      PID:840
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" C:\Windows\system32\mscories.dll,Install
      4⤵
      PID:268
  - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level
      4⤵
      PID:464
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4a7688,0x13f4a7698,0x13f4a76a8
        5⤵
        
        PID:396
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        5⤵
        
        PID:2464
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4a7688,0x13f4a7698,0x13f4a76a8
        6⤵
        
        PID:2828
  - - C:\Windows\System32\1woi1z.exe
      "C:\Windows\System32\1woi1z.exe"
      4⤵
      PID:2224
  - - C:\Program Files\Windows Sidebar\sidebar.exe
      "C:\Program Files\Windows Sidebar\sidebar.exe" /autoRun
      4⤵
      PID:1764
  - - C:\Windows\SysWOW64\runonce.exe
      C:\Windows\SysWOW64\runonce.exe /Run6432
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      PID:2276
    - - C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
        
        "C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe" /DelayServices
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1680
  - - C:\Windows\System32\mctadmin.exe
      "C:\Windows\System32\mctadmin.exe"
      4⤵
      Drops desktop.ini file(s)
      PID:2320
  - - C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      4⤵
      Enumerates system info in registry
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:2112
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\lolipop\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\lolipop\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\lolipop\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xbc,0xc0,0xc4,0x90,0xc8,0x7fef4929758,0x7fef4929768,0x7fef4929778
        5⤵
        
        PID:2576
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:2
        5⤵
        
        PID:2788
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1480 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2400
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1524 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1004
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2116 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2836
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2128 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2576 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:984
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2600 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1916
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3324 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1956
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3664 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:2
        5⤵
        
        PID:2292
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=1432 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1232
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4036 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:624
    - - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
        5⤵
        
        PID:1312
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4a7688,0x13f4a7698,0x13f4a76a8
        6⤵
        
        PID:2568
      - C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\Google\Chrome\Application\master_preferences" --create-shortcuts=1 --install-level=0
        6⤵
        
        PID:1372
        
        C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe
        
        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x154,0x158,0x15c,0x128,0x160,0x13f4a7688,0x13f4a7698,0x13f4a76a8
        7⤵
        
        PID:1616
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4032 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:548
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3684 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4352 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3676 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1268
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4296 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2160
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2876 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2200
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2616 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1924
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=2800 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --mojo-platform-channel-handle=4280 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1536
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --mojo-platform-channel-handle=2692 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1348
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --mojo-platform-channel-handle=2960 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2768
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --mojo-platform-channel-handle=2676 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2908
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2228 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2036
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2552 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2196
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2440
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:568
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2276 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2504
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=2600 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2312
    - - C:\Users\lolipop\Downloads\MBSetup.exe
        
        "C:\Users\lolipop\Downloads\MBSetup.exe"
        5⤵
        
        PID:1356
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1800
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --mojo-platform-channel-handle=2996 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1948
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --mojo-platform-channel-handle=3660 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:896
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --mojo-platform-channel-handle=4612 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1028
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-databases --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --mojo-platform-channel-handle=4472 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2216
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2760
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --mojo-platform-channel-handle=4104 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1860
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --mojo-platform-channel-handle=5272 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2460
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=5428 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:1620
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5576 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --mojo-platform-channel-handle=4064 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2488
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5460 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:3020
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6248 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1352
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6328 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:1912
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6332 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6272 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:8
        5⤵
        
        PID:2664
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=49 --mojo-platform-channel-handle=6252 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:804
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --mojo-platform-channel-handle=6296 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2540
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --mojo-platform-channel-handle=6048 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:904
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --mojo-platform-channel-handle=6092 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2336
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=53 --mojo-platform-channel-handle=6324 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2380
    - - C:\Program Files\Google\Chrome\Application\chrome.exe
        
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=54 --mojo-platform-channel-handle=5620 --field-trial-handle=1320,i,5340095243881181717,1971709067398710554,131072 /prefetch:1
        5⤵
        
        PID:2376
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  PID:2988

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:3016

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:872

C:\Windows\system32\rundll32.exe
rundll32.exe uxtheme.dll,#64 C:\Windows\resources\Themes\Aero\Aero.msstyles?NormalColor?NormalSize
1⤵
PID:2732

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2724

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{86D5EB8A-859F-4C7B-A76B-2BD819B7A850}
1⤵
PID:2536

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{E10F6C3A-F1AE-4ADC-AA9D-2FE65525666E}
1⤵
PID:1300

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2132

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:2160

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1760
- C:\Program Files (x86)\BonziBuddy432\Uninstall.exe
  "C:\Program Files (x86)\BonziBuddy432\Uninstall.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2128
- - C:\Users\lolipop\AppData\Local\Temp\Uninstall.exe
    "C:\Users\lolipop\AppData\Local\Temp\Uninstall.exe" end
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1484

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:756

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e4
1⤵
PID:1288

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:1692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

System Binary Proxy Execution

T1218

Rundll32

T1218.011

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery