sality | 6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality
Sality family
sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
327	464	firefox.exe
355	2024	avg_antivirus_free_setup.exe

Uses Session Manager for persistence 2 TTPs 1 IoCs

Creates Session Manager registry key to run executable early in system boot.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Session Manager\BootExecute = 6100750074006f0063006800650063006b0020006100750074006f00630068006b0020002a0000006900630061007200750073005f0072007600720074002e0065007800650000000000	icarus.exe

Executes dropped EXE 7 IoCs

pid	Process
3832	avg_antivirus_free_setup.exe
2024	avg_antivirus_free_setup.exe
3488	avg_antivirus_free_online_setup.exe
2020	icarus.exe
4488	icarus_ui.exe
2792	icarus.exe
2352	icarus.exe

Loads dropped DLL 4 IoCs

pid	Process
2024	avg_antivirus_free_setup.exe
3488	avg_antivirus_free_online_setup.exe
2792	icarus.exe
2352	icarus.exe

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Enumerates connected drives 3 TTPs 21 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\L:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\N:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\T:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\V:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\X:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\Z:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\D:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\M:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\S:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\Y:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\K:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\I:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\J:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\O:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\U:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\H:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\P:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\Q:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\R:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\W:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened (read-only)	\??\G:	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Writes to the Master Boot Record (MBR) 1 TTPs 5 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_online_setup.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	icarus.exe
File opened for modification	\??\PhysicalDrive0	avg_antivirus_free_setup.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\autorun.inf	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened for modification	F:\autorun.inf	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\icarus_rvrt.exe	icarus.exe
File opened for modification	C:\Windows\system32\icarus_rvrt.exe	icarus.exe

UPX packed file 40 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2464-1-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-4-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-10-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-17-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-19-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-6-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-9-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-5-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-20-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-3-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-21-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-22-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-23-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-24-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-26-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-27-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-297-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-354-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-370-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-374-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-377-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-380-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-388-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-390-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-391-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-393-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-395-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-407-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-410-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-415-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-416-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-419-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-420-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-430-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-431-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-443-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-444-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-459-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-473-0x0000000000770000-0x000000000182A000-memory.dmp	upx
behavioral1/memory/2464-474-0x0000000000770000-0x000000000182A000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\AVG\Antivirus\Licenses\JsonCpp.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-file-l2-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\sensitiveData.js.ipending.a1c7ca14.lzma	icarus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-hu.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ms.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\Crypto++.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\AvDump.exe.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\mainLayoutCss.css.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\napiExtensions.js.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\RescueDisk\background-loading.png.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\msvcp140.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\aswRunDll.exe.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswhook.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\dnscrypt-proxy.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\mhook.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\fr.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\libEGL.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\firewall.js.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-ko.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-timezone-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\da.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswidpm.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\RescueDisk\aswPECommander.exe.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\dll_loader.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\CommChannel.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-processenvironment-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Inf\x64\avgElam.sys.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\ru.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\antiTrack.js.ipending.a1c7ca14.lzma	icarus.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File created	C:\Program Files\AVG\Antivirus\aswCmnOS.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-crt-filesystem-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\fil.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\he.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\it.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\pt-BR.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\feedbackForm.js.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\mainWindow.html.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\uet_client.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\bsdiff.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\RegSvr.exe.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\bg.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-sv_SE.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\OpenSSL.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\aswAv.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-synch-l1-2-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\avg.local_vc142.crt\api-ms-win-core-synch-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\setup\asw0d0bb515f934255d.tmp	icarus.exe
File created	C:\Program Files\AVG\Antivirus\x86\aswCmnBS.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\nos.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-interlocked-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\locales\hr.pak.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-id.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\pugixml.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\xxHash.txt.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\anen.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\api-ms-win-core-datetime-l1-1-0.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\browserExtensions.js.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\locale-fr.json.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\avg.local_vc142.crt\vccorlib140.dll.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\gui_resources\default_av\update.js.ipending.a1c7ca14.lzma	icarus.exe
File created	C:\Program Files\AVG\Antivirus\Licenses\rapidjson.txt.ipending.a1c7ca14.lzma	icarus.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\e57a47d	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
File opened for modification	C:\Windows\SYSTEM.INI	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe:Zone.Identifier	firefox.exe

Embeds OpenSSL 1 IoCs

Embeds OpenSSL, may be used to circumvent TLS interception.

resource	yara_rule
behavioral1/files/0x00070000000282f0-3939.dat	embeds_openssl

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	avg_antivirus_free_online_setup.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8660	AVGBrowserUpdate.exe

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus_ui.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	icarus.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	icarus.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2206060733-4028293381-3488472159-1000_Classes\Local Settings	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Key created	\REGISTRY\USER\S-1-5-21-2206060733-4028293381-3488472159-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F	avg_antivirus_free_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\7CCD586D-2ABC-42FF-A23B-3731F4F183D9 = "65F115A51CCCDBF623206AEDE3B3D8A4"	avg_antivirus_free_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\5E1D6A55-0134-486E-A166-38C2E4919BB1 = "AQAAANCMnd8BFdERjHoAwE/Cl+sBAAAAGnEv/mc12UmWPSnJ2IV4tQQAAAACAAAAAAAQZgAAAAEAACAAAAD1XDgMsuxGu1ZkuosgRZVO/GCNtJZmqdJ6AvDaTiyXbQAAAAAOgAAAAAIAACAAAAANdyImgsWFkEN9QsGPycpmMqGPeOSbGvE96mxJKW9ZTjAAAADg8YbL7mUeRxUJUSpWIZ0xlwnmxvkkOaLfU0UP2rlV6fPvYu3ytdTqpGRoRAOhnAVAAAAAkTLTwObQPw4Rg4tn5yJDDNS12fxTsrv7ZaQ6JztXIf46/U9iwdJHEIHWQEoK/CfHwARLjx1CZFrWYR1cdHve5A=="	avg_antivirus_free_online_setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\C06AEB9D-8774-46E7-8160-8321BCD14D9F\56C7A9DA-4B11-406A-8B1A-EFF157C294D6 = "2ec9291d-a76f-49e0-858b-47d7ad8a0d05"	avg_antivirus_free_online_setup.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
4488	icarus_ui.exe
4488	icarus_ui.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
Token: SeDebugPrivilege	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Suspicious use of FindShellTrayWindow 23 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
3488	avg_antivirus_free_online_setup.exe
4488	icarus_ui.exe

Suspicious use of SendNotifyMessage 20 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe

Suspicious use of SetWindowsHookEx 15 IoCs

pid	Process
464	firefox.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
3832	avg_antivirus_free_setup.exe
464	firefox.exe
464	firefox.exe
464	firefox.exe
2024	avg_antivirus_free_setup.exe
3488	avg_antivirus_free_online_setup.exe
2020	icarus.exe
4488	icarus_ui.exe
4488	icarus_ui.exe
2792	icarus.exe
2352	icarus.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 816	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	9
PID 2464 wrote to memory of 824	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	10
PID 2464 wrote to memory of 1068	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	17
PID 2464 wrote to memory of 3004	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	51
PID 2464 wrote to memory of 3064	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	52
PID 2464 wrote to memory of 3212	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	54
PID 2464 wrote to memory of 3688	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	57
PID 2464 wrote to memory of 3820	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	58
PID 2464 wrote to memory of 4040	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	59
PID 2464 wrote to memory of 2060	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	60
PID 2464 wrote to memory of 3196	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	61
PID 2464 wrote to memory of 4180	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	62
PID 2464 wrote to memory of 4380	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	63
PID 2464 wrote to memory of 2972	2464	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe	74
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 1380 wrote to memory of 464	1380	firefox.exe	82
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83
PID 464 wrote to memory of 3856	464	firefox.exe	83

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:816

C:\Windows\system32\fontdrvhost.exe
"fontdrvhost.exe"
1⤵
PID:824

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
PID:1068

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:3004

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:3064

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3212

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3688
- C:\Users\Admin\AppData\Local\Temp\6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe
  "C:\Users\Admin\AppData\Local\Temp\6a60a1967fd505729c77b257d46e311b31bfb52a7ffcd194bff9aa005405902a.exe"
  2⤵
  - Modifies firewall policy service
  - UAC bypass
  - Windows security bypass
  - Windows security modification
  - Checks whether UAC is enabled
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2464
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Downloads MZ/PE file
    - Subvert Trust Controls: Mark-of-the-Web Bypass
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:464
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2016 -parentBuildID 20240401114208 -prefsHandle 1944 -prefMapHandle 1908 -prefsLen 27183 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1854bd87-bf39-42b0-a7ed-7a4e34d15b1e} 464 "\\.\pipe\gecko-crash-server-pipe.464" gpu
      4⤵
      PID:3856
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2432 -parentBuildID 20240401114208 -prefsHandle 2416 -prefMapHandle 2412 -prefsLen 27061 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c460b70c-6fe2-4642-835d-26b0be33075f} 464 "\\.\pipe\gecko-crash-server-pipe.464" socket
      4⤵
      PID:1168
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1520 -childID 1 -isForBrowser -prefsHandle 3208 -prefMapHandle 2992 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d932588a-d6d2-4c6f-84e7-771e312ad456} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:392
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3968 -childID 2 -isForBrowser -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 32435 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b4e68cc-c679-4b01-a743-0d737c0b52e0} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:2432
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4776 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4760 -prefMapHandle 4688 -prefsLen 32435 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {87cfd600-784a-4ef1-a12a-5004a890a78e} 464 "\\.\pipe\gecko-crash-server-pipe.464" utility
      4⤵
      Checks processor information in registry
      PID:1924
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5328 -childID 3 -isForBrowser -prefsHandle 5308 -prefMapHandle 5172 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3c3fc75e-ee7d-4a78-a8f8-82e934c79088} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:2896
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5468 -childID 4 -isForBrowser -prefsHandle 5484 -prefMapHandle 5448 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e11b722-8dbe-4e50-8c58-a632550ca0ff} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:4296
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5740 -childID 5 -isForBrowser -prefsHandle 5660 -prefMapHandle 5348 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f045486-c4e6-43cc-ad03-fd113af71091} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:768
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6232 -childID 6 -isForBrowser -prefsHandle 6252 -prefMapHandle 6248 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7910ce85-6c20-42e1-b40c-4b115939ce57} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:4528
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4208 -childID 7 -isForBrowser -prefsHandle 5960 -prefMapHandle 5964 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7266af68-5010-48d7-9b10-3e9ac96879a3} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:4780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3788 -childID 8 -isForBrowser -prefsHandle 6540 -prefMapHandle 1272 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb1bd53b-6e08-4dbb-ad96-de37be47779f} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:4460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6768 -childID 9 -isForBrowser -prefsHandle 3100 -prefMapHandle 6692 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c65f4d9-aa83-458b-833e-466a5b8111a4} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:1592
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3068 -childID 10 -isForBrowser -prefsHandle 3364 -prefMapHandle 3376 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f1d5a15-470b-4f0d-8f50-543554231a04} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:2112
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=6756 -childID 11 -isForBrowser -prefsHandle 6736 -prefMapHandle 6752 -prefsLen 28044 -prefMapSize 244658 -jsInitHandle 904 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {400cd50e-8e9a-4150-9b36-05c453d92733} 464 "\\.\pipe\gecko-crash-server-pipe.464" tab
      4⤵
      PID:3036
  - - C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
      "C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3832
- C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe
  "C:\Users\Admin\Downloads\avg_antivirus_free_setup.exe"
  2⤵
  - Downloads MZ/PE file
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2024
- - C:\Windows\Temp\asw.248927bdf67afd73\avg_antivirus_free_online_setup.exe
    "C:\Windows\Temp\asw.248927bdf67afd73\avg_antivirus_free_online_setup.exe" /cookie:mmm_bav_003_999_d9b_m:dlid_FREEGSR-HP /ga_clientid:171b1e43-d219-4090-bfea-07dc6b7aeab5 /edat_dir:C:\Windows\Temp\asw.248927bdf67afd73 /geo:GB
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    PID:3488
  - - C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\common\icarus.exe
      C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\common\icarus.exe /icarus-info-path:C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\icarus-info.xml /install /cookie:mmm_bav_003_999_d9b_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.248927bdf67afd73 /geo:GB /track-guid:171b1e43-d219-4090-bfea-07dc6b7aeab5 /sssid:3488
      4⤵
      Executes dropped EXE
      Writes to the Master Boot Record (MBR)
      Checks processor information in registry
      Suspicious use of SetWindowsHookEx
      PID:2020
    - - C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\common\icarus_ui.exe
        
        C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\common\icarus_ui.exe /cookie:mmm_bav_003_999_d9b_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.248927bdf67afd73 /geo:GB /track-guid:171b1e43-d219-4090-bfea-07dc6b7aeab5 /sssid:3488 /er_master:master_ep_974ea1bc-b166-4dda-a163-bba5eba0db7e /er_ui:ui_ep_e2a358df-d824-41a8-85cd-47cce9ba6014
        5⤵
        Executes dropped EXE
        Checks processor information in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        
        PID:4488
    - - C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\avg-av\icarus.exe
        
        C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\avg-av\icarus.exe /cookie:mmm_bav_003_999_d9b_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.248927bdf67afd73 /geo:GB /track-guid:171b1e43-d219-4090-bfea-07dc6b7aeab5 /sssid:3488 /er_master:master_ep_974ea1bc-b166-4dda-a163-bba5eba0db7e /er_ui:ui_ep_e2a358df-d824-41a8-85cd-47cce9ba6014 /er_slave:avg-av_slave_ep_3ecaba87-dce1-4e83-a233-aad5c22f8038 /slave:avg-av
        5⤵
        Uses Session Manager for persistence
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Drops file in System32 directory
        Drops file in Program Files directory
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:sw_avgNdis
        6⤵
        
        PID:2896
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /netservice:avgNdisFlt /catalog:avgNdisFlt.cat
        6⤵
        
        PID:5012
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRdr2.cat
        6⤵
        
        PID:3104
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgHwid.cat
        6⤵
        
        PID:5756
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgVmm.cat
        6⤵
        
        PID:2432
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /uninstall /catalog:avgRvrt.cat
        6⤵
        
        PID:4840
      - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
        
        "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer /reg
        6⤵
        
        PID:9888
      - C:\Program Files\AVG\Antivirus\AvEmUpdate.exe
        
        "C:\Program Files\AVG\Antivirus\AvEmUpdate.exe" /installer
        6⤵
        
        PID:6696
      - C:\Program Files\AVG\Antivirus\x86\RegSvr.exe
        
        "C:\Program Files\AVG\Antivirus\x86\RegSvr.exe" "C:\Program Files\AVG\Antivirus\x86\aswAMSI.dll"
        6⤵
        
        PID:9764
      - C:\Program Files\AVG\Antivirus\RegSvr.exe
        
        "C:\Program Files\AVG\Antivirus\RegSvr.exe" "C:\Program Files\AVG\Antivirus\aswAMSI.dll"
        6⤵
        
        PID:8448
      - C:\Program Files\AVG\Antivirus\SetupInf.exe
        
        "C:\Program Files\AVG\Antivirus\SetupInf.exe" /catinstall:"C:\Program Files\AVG\Antivirus\crts.cat" /basename:pkg_{af98c830-528a-46b9-a60e-2db5d9a76b77}.cat /crtid:E89476E7569FC7413EA11A4461D6E3E784B8B699
        6⤵
        
        PID:5492
      - C:\Program Files\AVG\Antivirus\wsc_proxy.exe
        
        "C:\Program Files\AVG\Antivirus\wsc_proxy.exe" /svc /register /ppl_svc
        6⤵
        
        PID:9252
        
        C:\Program Files\AVG\Antivirus\avDump.exe
        
        "C:\Program Files\AVG\Antivirus\avDump.exe" --pid 9252 --exception_ptr 00000034372FE810 --thread_id 9248 --dump_level 21 --dump_file "C:\ProgramData\AVG\Antivirus\log\unp31159532552161609i-manual.mdmp" --comment "Cause: VectoredExceptionHandler Reason: sd is not loaded Dump contains a C++ exception, its pointer is stored as Parameter[3] of the exception record. Use .ecxr to see the line of exception instantiation." --min_interval 60
        7⤵
        
        PID:10212
      - C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe
        
        "C:\Program Files\Common Files\AVG\Icarus\avg-av\aswOfferTool.exe" /install_secure_browser /cmd:"/make_default /run_source=avg_install /language=en" /config_def:"C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\avg-av\config.def"
        6⤵
        
        PID:9932
        
        C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe
        
        "C:\Program Files\Common Files\AVG\Icarus\avg-av\securebrowser_setup.exe" /s /make_default /run_source=avg_install /language=en
        7⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\nsv26EF.tmp\AVGBrowserUpdateSetup.exe
        
        AVGBrowserUpdateSetup.exe /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies"
        8⤵
        
        PID:10140
        
        C:\Program Files (x86)\GUM31F9.tmp\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\GUM31F9.tmp\AVGBrowserUpdate.exe" /silent /install "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies"
        9⤵
        
        PID:5108
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regsvc
        10⤵
        
        PID:7832
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /regserver
        10⤵
        
        PID:6576
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        11⤵
        
        PID:564
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        11⤵
        
        PID:7172
        
        C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\1.8.1693.6\AVGBrowserUpdateComRegisterShell64.exe"
        11⤵
        
        PID:8408
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgb21haGFpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHVwZGF0ZXJ2ZXJzaW9uPSIxLjguMTY5My42IiBzaGVsbF92ZXJzaW9uPSIxLjguMTY5My42IiBpc21hY2hpbmU9IjEiIGlzX29tYWhhNjRiaXQ9IjAiIGlzX29zNjRiaXQ9IjEiIHNlc3Npb25pZD0iezMzMkM1NzUxLUIwQkEtNDlBRi04NjA1LUNGODAxMDQzMEREQX0iIGNlcnRfZXhwX2RhdGU9IjIwMjUwOTE3IiB1c2VyaWQ9InsxNkEyQkYzRS1BMTc2LTQwMkMtQkMwRS03Qzg5NzY2M0VBRTJ9IiB1c2VyaWRfZGF0ZT0iMjAyNTAyMDEiIG1hY2hpbmVpZD0iezAwMDBDQkM0LUFBNTMtOTMyRC1GNjQ2LTgzNTZEQzZDRUMyNH0iIG1hY2hpbmVpZF9kYXRlPSIyMDI1MDIwMSIgaW5zdGFsbHNvdXJjZT0ib3RoZXJpbnN0YWxsY21kIiB0ZXN0c291cmNlPSJhdXRvIiByZXF1ZXN0aWQ9Ins0RjRDN0E4NS05MTE3LTQ2NEYtOUI0RS05MTJCNjgwNzdDMzJ9IiBkZWR1cD0iY3IiIGRvbWFpbmpvaW5lZD0iMCI-PGh3IHBoeXNtZW1vcnk9IjgiIHNzZT0iMSIgc3NlMj0iMSIgc3NlMz0iMSIgc3NzZTM9IjEiIHNzZTQxPSIxIiBzc2U0Mj0iMSIgYXZ4PSIxIi8-PG9zIHBsYXRmb3JtPSJ3aW4iIHZlcnNpb249IjEwLjAuMTkwNDQuNDUyOSIgc3A9IiIgYXJjaD0ieDY0Ii8-PGFwcCBhcHBpZD0iezFDODlFRjJGLUE4OEUtNERFMC05N0ZFLUNCNDBDOEU0RkVFQX0iIHZlcnNpb249IiIgbmV4dHZlcnNpb249IjEuOC4xNjkzLjYiIGxhbmc9ImVuIiBicmFuZD0iNzYwMiIgY2xpZW50PSIiPjxldmVudCBldmVudHR5cGU9IjIiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGluc3RhbGxfdGltZV9tcz0iNzgxIi8-PC9hcHA-PC9yZXF1ZXN0Pg
        10⤵
        System Network Configuration Discovery: Internet Connection Discovery
        
        PID:8660
        
        C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
        
        "C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /handoff "bundlename=AVG Secure Browser&appguid={48F69C39-1356-4A7B-A899-70E3539D4982}&appname=AVG Secure Browser&needsadmin=true&lang=en&brand=7602&installargs=--no-create-user-shortcuts --make-chrome-default --force-default-win10 --auto-import-data%3Dfirefox --import-cookies" /installsource otherinstallcmd /sessionid "{332C5751-B0BA-49AF-8605-CF8010430DDA}" /silent
        10⤵
        
        PID:9804
      - C:\Program Files\Common Files\AVG\Overseer\overseer.exe
        
        "C:\Program Files\Common Files\AVG\Overseer\overseer.exe" /skip_uptime /skip_remediations
        6⤵
        
        PID:404
    - - C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\avg-av-vps\icarus.exe
        
        C:\Windows\Temp\asw-d1913541-2a60-4fd0-88dd-11723420b3c6\avg-av-vps\icarus.exe /cookie:mmm_bav_003_999_d9b_m:dlid_FREEGSR-HP /edat_dir:C:\Windows\Temp\asw.248927bdf67afd73 /geo:GB /track-guid:171b1e43-d219-4090-bfea-07dc6b7aeab5 /sssid:3488 /er_master:master_ep_974ea1bc-b166-4dda-a163-bba5eba0db7e /er_ui:ui_ep_e2a358df-d824-41a8-85cd-47cce9ba6014 /er_slave:avg-av-vps_slave_ep_25fefdc1-4124-4a17-85ba-45794818de2f /slave:avg-av-vps
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Writes to the Master Boot Record (MBR)
        Checks processor information in registry
        Suspicious use of SetWindowsHookEx
        
        PID:2352
      - C:\Program Files\AVG\Antivirus\defs\25020104\engsup.exe
        
        "C:\Program Files\AVG\Antivirus\defs\25020104\engsup.exe" /prepare_definitions_folder
        6⤵
        
        PID:9656
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /4
  2⤵
  PID:6112
- C:\Program Files\AVG\Antivirus\AVGUI.exe
  "C:\Program Files\AVG\Antivirus\AVGUI.exe" /welcome
  2⤵
  PID:4924

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3820

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4040

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2060

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3196

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4180

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:4380

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
PID:2972

C:\Windows\System32\smartscreen.exe
C:\Windows\System32\smartscreen.exe -Embedding
1⤵
PID:2956

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3932

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
PID:2184

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
PID:7544

C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe
"C:\Program Files (x86)\AVG\Browser\Update\AVGBrowserUpdate.exe" /svc
1⤵
PID:8432

C:\Program Files\AVG\Antivirus\afwServ.exe
"C:\Program Files\AVG\Antivirus\afwServ.exe"
1⤵
PID:8228

C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe
"C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus.exe" /repair:avg-av /silent /ii_reason:FwSvcRecovery
1⤵
PID:1820
- C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-a752cbe8-e986-482c-ad79-e0862a820ddc\icarus.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av-vps\temp\asw-a752cbe8-e986-482c-ad79-e0862a820ddc\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_8a65c410-7572-446a-861a-be58e283c74b /er_ui:ui_ep_a68d2533-43b8-4c49-85f1-4696d41a3528 /er_slave:avg-av-vps_slave_ep_9c0204f6-a8ea-48fe-b781-82a608e2c8ad /slave:avg-av-vps
  2⤵
  PID:6220
- C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-a752cbe8-e986-482c-ad79-e0862a820ddc\icarus.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av\temp\asw-a752cbe8-e986-482c-ad79-e0862a820ddc\icarus.exe" /silent /ii_reason:FwSvcRecovery /er_master:master_ep_8a65c410-7572-446a-861a-be58e283c74b /er_ui:ui_ep_a68d2533-43b8-4c49-85f1-4696d41a3528 /er_slave:avg-av_slave_ep_982f31c4-9e8d-48ad-8a07-4b521af469cc /slave:avg-av
  2⤵
  PID:5968
- C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe
  "C:\Program Files\Common Files\AVG\Icarus\avg-av\icarus_ui.exe" /sbr /eid=c2261447-622d-49dc-87de-e46516926c14
  2⤵
  PID:236

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2632
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  PID:7156

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:6248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery