Overview
overview
10Static
static
10The-MALWAR...er.zip
windows10-ltsc_2021-x64
1The-MALWAR...00.exe
windows10-ltsc_2021-x64
The-MALWAR...ta.exe
windows10-ltsc_2021-x64
3The-MALWAR...na.exe
windows10-ltsc_2021-x64
The-MALWAR...mb.exe
windows10-ltsc_2021-x64
5The-MALWAR...en.exe
windows10-ltsc_2021-x64
5The-MALWAR...bi.vbs
windows10-ltsc_2021-x64
10The-MALWAR...mr.vbs
windows10-ltsc_2021-x64
4The-MALWAR...ll.exe
windows10-ltsc_2021-x64
6The-MALWAR...ug.exe
windows10-ltsc_2021-x64
6The-MALWAR...le.exe
windows10-ltsc_2021-x64
3The-MALWAR...an.bat
windows10-ltsc_2021-x64
1The-MALWAR...er.exe
windows10-ltsc_2021-x64
3The-MALWAR...n.docx
windows10-ltsc_2021-x64
1The-MALWAR...er.exe
windows10-ltsc_2021-x64
7The-MALWAR...as.exe
windows10-ltsc_2021-x64
3The-MALWAR...ve.apk
windows10-ltsc_2021-x64
3The-MALWAR...er.exe
windows10-ltsc_2021-x64
The-MALWAR...ce.exe
windows10-ltsc_2021-x64
3The-MALWAR....C.exe
windows10-ltsc_2021-x64
10The-MALWAR...Lz.bat
windows10-ltsc_2021-x64
8The-MALWAR...ou.exe
windows10-ltsc_2021-x64
3The-MALWAR...MZ.exe
windows10-ltsc_2021-x64
7The-MALWAR...um.apk
windows10-ltsc_2021-x64
3The-MALWAR...st.exe
windows10-ltsc_2021-x64
8The-MALWAR...er.exe
windows10-ltsc_2021-x64
8The-MALWAR...RC.exe
windows10-ltsc_2021-x64
8The-MALWAR...re.apk
windows10-ltsc_2021-x64
3The-MALWAR...or.exe
windows10-ltsc_2021-x64
The-MALWAR....0.exe
windows10-ltsc_2021-x64
10The-MALWAR...z.html
windows10-ltsc_2021-x64
4The-MALWAR...er.exe
windows10-ltsc_2021-x64
Analysis
- max time kernel
440s - max time network
449s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260130-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
22/02/2026, 01:58
Static task
static1
31 signatures
Behavioral task
behavioral1
Sample
The-MALWARE-Repo-master.zip
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral2
Sample
The-MALWARE-Repo-master/Trojan/000.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral3
Sample
The-MALWARE-Repo-master/Trojan/Alerta.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral4
Sample
The-MALWARE-Repo-master/Trojan/Ana.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
6 signatures
900 seconds
Behavioral task
behavioral5
Sample
The-MALWARE-Repo-master/Trojan/ArcticBomb.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral6
Sample
The-MALWARE-Repo-master/Trojan/BlueScreen.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral7
Sample
The-MALWARE-Repo-master/Trojan/Bolbi.vbs
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
29 signatures
900 seconds
Behavioral task
behavioral8
Sample
The-MALWARE-Repo-master/Trojan/Carewmr.vbs
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
13 signatures
900 seconds
Behavioral task
behavioral9
Sample
The-MALWARE-Repo-master/Trojan/ClassicShell.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral10
Sample
The-MALWARE-Repo-master/Trojan/ColorBug.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral11
Sample
The-MALWARE-Repo-master/Trojan/DesktopPuzzle.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral12
Sample
The-MALWARE-Repo-master/Trojan/DudleyTrojan.bat
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
0 signatures
900 seconds
Behavioral task
behavioral13
Sample
The-MALWARE-Repo-master/Trojan/FlashKiller.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
2 signatures
900 seconds
Behavioral task
behavioral14
Sample
The-MALWARE-Repo-master/Trojan/Frankenstein.docx
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral15
Sample
The-MALWARE-Repo-master/Trojan/FreeYoutubeDownloader.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
10 signatures
900 seconds
Behavioral task
behavioral16
Sample
The-MALWARE-Repo-master/Trojan/Gas.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral17
Sample
The-MALWARE-Repo-master/Trojan/Grave.apk
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral18
Sample
The-MALWARE-Repo-master/Trojan/HMBlocker.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
Behavioral task
behavioral19
Sample
The-MALWARE-Repo-master/Trojan/IconDance.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral20
Sample
The-MALWARE-Repo-master/Trojan/Illerka.C.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
10 signatures
900 seconds
Behavioral task
behavioral21
Sample
The-MALWARE-Repo-master/Trojan/L0Lz.bat
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
8 signatures
900 seconds
Behavioral task
behavioral22
Sample
The-MALWARE-Repo-master/Trojan/LoveYou.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
1 signatures
900 seconds
Behavioral task
behavioral23
Sample
The-MALWARE-Repo-master/Trojan/MEMZ.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
25 signatures
900 seconds
Behavioral task
behavioral24
Sample
The-MALWARE-Repo-master/Trojan/Malum.apk
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral25
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInfected_newest.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
5 signatures
900 seconds
Behavioral task
behavioral26
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInstaller.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral27
Sample
The-MALWARE-Repo-master/Trojan/Mist/MistInstallerRC.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral28
Sample
The-MALWARE-Repo-master/Trojan/Mobile_Legends_Adventure.apk
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
3 signatures
900 seconds
Behavioral task
behavioral29
Sample
The-MALWARE-Repo-master/Trojan/MrsMajors/BossDaMajor/BossDaMajor.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
22 signatures
900 seconds
Behavioral task
behavioral30
Sample
The-MALWARE-Repo-master/Trojan/MrsMajors/MrsMajor3.0.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
10 signatures
900 seconds
Behavioral task
behavioral31
Sample
The-MALWARE-Repo-master/Trojan/Offiz.html
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
13 signatures
900 seconds
Behavioral task
behavioral32
Sample
The-MALWARE-Repo-master/Trojan/PCToaster.exe
Resource
win10ltsc2021-20260130-en
windows10-ltsc_2021-x64
9 signatures
900 seconds
General
- Target The-MALWARE-Repo-master/Trojan/Bolbi.vbs
- Size 46KB
- Sample260222-cdtt7sb16e
- SHA256 ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51
- MD5 99ec3237394257cb0b5c24affe458f48
- SHA1 5300e68423da9712280e601b51622c4b567a23a4
- SHA512 af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraB:m7BGV95hIG1/d49gsCDsl
- TLSH T11B23A78847C164F09150BC09B845FA378375CEC07C6B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- UAC bypass 3 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe - Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 12 2784 wscript.exe - Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Disables cmd.exe use via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableCMD = "1" wscript.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\setup.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdsched.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msert.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner32.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uTorrent.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updater.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhost.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icacls.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vbsedit.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uTorrent.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uninstall.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adwcleaner_5.005.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VirtualBox.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\plugin-hang-ui.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashreporter.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procxp.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msert.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCui.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\takeown.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskhost.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\installer.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\update.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mdsched.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit32.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit33.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\procxp.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wmic.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashreporter.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner.exe wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner64.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit33.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\plugin-hang-ui.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\htaedit.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adwcleaner_5.005.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iexplore.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mssecse.exe wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCleaner32.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mbam.exe\Debugger = "wscript.exe C:\\Users\\Public\\ghostroot\\Message.vbs" wscript.exe - Possible privilege escalation attempt 4 IoCs
pid Process 1156 icacls.exe 1336 takeown.exe 4296 icacls.exe 3912 takeown.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\Geo\Nation wscript.exe - Impair Defenses: Safe Mode Boot 1 TTPs 7 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\CBDHSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\iai2c.sys reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\Power reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\ProfSvc reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\SerCx2.sys reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\UserManager reg.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\WinDefend reg.exe - Modifies file permissions 1 TTPs 4 IoCs
pid Process 1156 icacls.exe 1336 takeown.exe 4296 icacls.exe 3912 takeown.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bolbi = "C:\\Users\\Public\\Ghostroot\\Bolbi.vbs" wscript.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: explorer.exe File opened (read-only) \??\F: explorer.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Public\\ghostroot\\8ydfdsE.jpg" wscript.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files (x86)\Mozilla Maintenance Service\logs\Open125.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows NT\Clap14.vbs wscript.exe File created C:\Program Files (x86)\Windows Photo Viewer\es-ES\Open188.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Open151.vbs wscript.exe File opened for modification C:\Program Files\Windows Defender Advanced Threat Protection\de-DE\Open121.vbs wscript.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\ja-JP\Open67.vbs wscript.exe File created C:\Program Files\WindowsPowerShell\Modules\Open35.vbs wscript.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\Open230.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\es-ES\Open177.vbs wscript.exe File created C:\Program Files\Windows Sidebar\Shared Gadgets\Open204.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ja-JP\Open2.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Open25.vbs wscript.exe File created C:\Program Files (x86)\WindowsPowerShell\Clap80.vbs wscript.exe File created C:\Program Files\Java\jdk-1.8\Open138.vbs wscript.exe File created C:\Program Files\Mozilla Firefox\browser\Open150.vbs wscript.exe File opened for modification C:\Program Files\Windows Defender\en-US\Open151.vbs wscript.exe File created C:\Program Files\WindowsApps\Deleted\Open5.vbs wscript.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\Open115.vbs wscript.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Clap159.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Media Player\uk-UA\Open154.vbs wscript.exe File created C:\Program Files\dotnet\shared\Open150.vbs wscript.exe File created C:\Program Files\Windows NT\TableTextService\Open229.vbs wscript.exe File created C:\Program Files (x86)\Common Files\Java\Open224.vbs wscript.exe File created C:\Program Files (x86)\Windows Media Player\Clap34.vbs wscript.exe File opened for modification C:\Program Files\Internet Explorer\Clap9.vbs wscript.exe File created C:\Program Files\Windows NT\TableTextService\Open27.vbs wscript.exe File opened for modification C:\Program Files\Windows Photo Viewer\es-ES\Open222.vbs wscript.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Open168.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Media Player\Visualizations\Open178.vbs wscript.exe File created C:\Program Files\7-Zip\Lang\Open84.vbs wscript.exe File opened for modification C:\Program Files\Windows Photo Viewer\uk-UA\Open15.vbs wscript.exe File created C:\Program Files (x86)\Common Files\Java\Open234.vbs wscript.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Open63.vbs wscript.exe File opened for modification C:\Program Files (x86)\Microsoft\Temp\Open194.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Defender\it-IT\Open60.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Media Player\en-US\Open179.vbs wscript.exe File created C:\Program Files (x86)\Windows NT\Accessories\Open6.vbs wscript.exe File opened for modification C:\Program Files\Common Files\Clap72.vbs wscript.exe File created C:\Program Files\Internet Explorer\ja-JP\Open119.vbs wscript.exe File created C:\Program Files (x86)\Windows Defender\fr-FR\Open193.vbs wscript.exe File created C:\Program Files (x86)\Windows Media Player\uk-UA\Open75.vbs wscript.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\en-US\Open130.vbs wscript.exe File created C:\Program Files (x86)\Windows Sidebar\Shared Gadgets\Open189.vbs wscript.exe File created C:\Program Files\WindowsPowerShell\Clap189.vbs wscript.exe File opened for modification C:\Program Files (x86)\Internet Explorer\de-DE\Open129.vbs wscript.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\Open64.vbs wscript.exe File opened for modification C:\Program Files (x86)\MSBuild\Microsoft\Open80.vbs wscript.exe File created C:\Program Files (x86)\Windows Defender\en-US\Open157.vbs wscript.exe File created C:\Program Files (x86)\Windows Media Player\de-DE\Open151.vbs wscript.exe File created C:\Program Files\Windows Media Player\en-US\Open100.vbs wscript.exe File opened for modification C:\Program Files\Windows Media Player\ja-JP\Open20.vbs wscript.exe File created C:\Program Files (x86)\Common Files\Oracle\Open203.vbs wscript.exe File opened for modification C:\Program Files (x86)\Internet Explorer\es-ES\Open142.vbs wscript.exe File created C:\Program Files (x86)\Internet Explorer\images\Open104.vbs wscript.exe File opened for modification C:\Program Files\Mozilla Firefox\fonts\Open167.vbs wscript.exe File opened for modification C:\Program Files\Windows Defender\Clap235.vbs wscript.exe File created C:\Program Files (x86)\Windows Media Player\Skins\Open166.vbs wscript.exe File created C:\Program Files (x86)\Windows NT\TableTextService\Open231.vbs wscript.exe File created C:\Program Files (x86)\Windows Photo Viewer\uk-UA\Open63.vbs wscript.exe File opened for modification C:\Program Files\7-Zip\Clap1.vbs wscript.exe File created C:\Program Files\Java\Clap32.vbs wscript.exe File opened for modification C:\Program Files\Windows Defender\de-DE\Open88.vbs wscript.exe File opened for modification C:\Program Files\Windows Defender\es-ES\Open87.vbs wscript.exe File created C:\Program Files\Windows Defender Advanced Threat Protection\Classification\Open25.vbs wscript.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32 wscript.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks SCSI registry key(s) 3 TTPs 58 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002 explorer.exe - Kills process with taskkill 1 IoCs
pid Process 1576 taskkill.exe - Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\s1159 = "Bolbi" wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\International\s2359 = "Bolbi" wscript.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000\Control Panel\Desktop wscript.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\en-US-N\\L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\fr-FR\\M1036Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech HW Voice Activation - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Elsa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\ja-JP-N\\tn1041.bin" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\AI041040" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1041" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.lnk\ = "exefile" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR en-US Lts Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ayumi - Japanese (Japan)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech_OneCore\\AudioInput\\TokenEnums\\MMAudioIn\\" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - German (Germany)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1033" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\L1040" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\VoiceActivation_HW_it-IT.dat" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "16000" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\de-DE-N\\r1031sr.lxa" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\es-ES-N\\c3082.fe" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "5218064" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.search SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40C" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "DebugPlugin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Sie haben %1 als Standardstimme ausgewählt." SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\MuiCache SearchApp.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.pif\ = "dllfile" cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\TTS\\en-US\\M1033Zira" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.search\ = "23" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Ichiro - Japanese (Japan)" SearchApp.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.lnk cmd.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{0B3398EA-00F1-418b-AA31-6F2F9BE5809B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR Engine (11.0) Text Normalization" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{15E16AEC-F2F0-4E52-B0DF-029D11E58E4B}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Zira - English (United States)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "40A;C0A" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lts Lexicon" SearchApp.exe Set value (int) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "0" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech SW Voice Activation - Spanish (Spain)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; computer=NativeSupported; address=NativeSupported; currency=NativeSupported; message=NativeSupported; url=NativeSupported; alphanumeric=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR ja-JP Locale Handler" SearchApp.exe Set value (data) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.PeopleExperienceHost_cw5n1h2txyewy\ApplicationFrame\Microsoft.Windows.PeopleExperienceHos = 6801000088020000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1040" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "CC" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "SR de-DE Lookup Lexicon" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\de-DE\\VoiceActivation_HW_de-DE.dat" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Speech Recognition Engine - en-US Embedded DNN v11.1" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\c1040.fe" SearchApp.exe Key created \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Male" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "MS-1036-110-WINMO-DNN" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\System32\\Speech_OneCore\\VoiceActivation\\it-IT\\sidubm.table" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "L1031" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{E164F996-FF93-4675-BDD8-6C47AB0B86B1}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Zira" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Mark" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "spell=NativeSupported; cardinal=GlobalSupported; ordinal=NativeSupported; date=GlobalSupported; time=GlobalSupported; telephone=NativeSupported; currency=NativeSupported; url=NativeSupported; address=NativeSupported; alphanumeric=NativeSupported; message=NativeSupported; computer=NativeSupported" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "{57523D96-B7F6-4D2C-8AFC-BCC5F5392E94}" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Microsoft Julie - French (France)" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "%windir%\\Speech_OneCore\\Engines\\SR\\it-IT-N\\tn1040.bin" SearchApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-2783838373-340812344-1280766377-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.search_cw5n1h2txyewy\SOFTWARE\Microsoft\Speech_OneCore\Isolated\ohDO1Sgy3MzgdEgEb4WYfDS4eik = "Near" SearchApp.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1576 taskkill.exe Token: SeTakeOwnershipPrivilege 1336 takeown.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeTakeOwnershipPrivilege 3912 takeown.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe Token: SeCreatePagefilePrivilege 1504 explorer.exe Token: SeShutdownPrivilege 1504 explorer.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe - Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe 1504 explorer.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 5068 StartMenuExperienceHost.exe 3956 TextInputHost.exe 3956 TextInputHost.exe 1504 explorer.exe 1404 SearchApp.exe 1504 explorer.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2728 wrote to memory of 2784 2728 WScript.exe 83 PID 2784 wrote to memory of 4792 2784 wscript.exe 92 PID 4792 wrote to memory of 1064 4792 cmd.exe 94 PID 4792 wrote to memory of 1040 4792 cmd.exe 95 PID 4792 wrote to memory of 776 4792 cmd.exe 96 PID 4792 wrote to memory of 1576 4792 cmd.exe 97 PID 4792 wrote to memory of 1504 4792 cmd.exe 98 PID 4792 wrote to memory of 1336 4792 cmd.exe 99 PID 4792 wrote to memory of 1156 4792 cmd.exe 100 PID 4792 wrote to memory of 3912 4792 cmd.exe 105 PID 4792 wrote to memory of 4296 4792 cmd.exe 108 - System policy modification 1 TTPs 31 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetTaskbar = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuPinnedList = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSecurityTab = "1" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "cscript.exe" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\TaskbarNoPinnedList = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoPinningToTaskbar = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "wmplayer.exe" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFind = "1" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "wscript.exe" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticecaption = "ATTENTION!" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\legalnoticetext = "Your PC has been wrecked by Bolbi!" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayContextMenu = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSaveSettings = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoTrayItemsDisplay = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "explorer.exe" wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ = "rpdbfk.exe" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "67108863" wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun wscript.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun\ wscript.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMorePrograms, = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFileAssociate = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1" wscript.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoStartMenuMFUprogramsList = "1" wscript.exe - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\System32\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Bolbi.vbs"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2728 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Local\Temp\The-MALWARE-Repo-master\Trojan\Bolbi.vbs" /elevated2⤵
- UAC bypass
- Badlisted process makes network request
- Disables cmd.exe use via registry modification
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2784 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Public\Ghostroot\KillDora.bat3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\System32\rundll32.exeC:\Windows\System32\RUNDLL32.EXE user32.dll, UpdatePerUserSystemParameters4⤵PID:1064
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal" /f4⤵
- Impair Defenses: Safe Mode Boot
PID:1040
-
-
C:\Windows\system32\reg.exereg delete "HKLM\System\CurrentControlSet\Control\SafeBoot\Network" /f4⤵PID:776
-
-
C:\Windows\system32\taskkill.exetaskkill /f /im explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1576
-
-
C:\Windows\explorer.exeexplorer.exe4⤵
- Boot or Logon Autostart Execution: Active Setup
- Enumerates connected drives
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1504
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\System32\4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:1336
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\System32 /Grant Users:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1156
-
-
C:\Windows\system32\takeown.exetakeown /f C:\Windows\4⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
C:\Windows\system32\icacls.exeicacls C:\Windows\ /Grant Users:F4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4296
-
-
-
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:5068
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:3956
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1404
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Image File Execution Options Injection
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
2Disable or Modify Tools
1Safe Mode Boot
1Modify Registry
5Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\USERS\ADMIN\DESKTOP\BOLBI.TXT
- Size 29B
- SHA256 cc2b26f9e750e05cd680ef5721d9269fe4c8d23cabf500a2ff9065b6b4f7e08c
- MD5 b37ed35ef479e43f406429bc36e68ec4
- SHA1 5e3ec88d9d13d136af28dea0d3c2529f5b6e3b82
- SHA512 d1c1ea6292d8113ce8f02a9ad3921e2d8632f036bdfa243bd6600a173ac0b1fc659f91b43c8d9ec0beaabb87d9654f5f231e98fde27e4d9bdfd5862ca5cb13b7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 56KB
- SHA256 d45b031dd3ffe856bfafe9468627dd477a7da767b3cfd2efaea3384400412800
- MD5 3a9d18f39c0c11fba44532f7c4a5dde5
- SHA1 0bc6e63bd7c44674ada840b9286062a540718801
- SHA512 0cae3540343aca1f332318b6e929cc263ca364b53c89436a4c2a3adca96dd2103b04dd20a18ec01516fac33f9fd9dc2481a19023bdc2321f454708cd237476d9
- SSDEEP 192:+lhKuZ9sc0mg38kzBwzPWEtjEZmGh0SkVFYuL138Dw:1uZ9sg1Y0WEdAkVFYuL13J
- TLSH T187433A647D76E8A5D50A193C0C2AEFDE1EA4FDC1DE5992677BF0FB8F883482B4814110
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db
- Size 56KB
- SHA256 e07d4257a78ba391e24cea5ef9e938d01ff05ee807905af3fd9219c85436127d
- MD5 79f72b9b2b45edfbc1a2b21f77e5a952
- SHA1 582733ee7f06a4a34697c3fdcd14fd69f5c567e5
- SHA512 48d42b68d5db08fb7664178699c447ef07329cdf4374cd353467d3b9c670b0124b4c19e81c33797d631d7b100b74e4fbb2aa930d8d97e0f2feff3bfdc0f97404
- SSDEEP 192:mlhKuZ9sc0x1g38kzBwzPWEtjEZmGh0SOVFYuL138Dw:duZ9sL11Y0WEdAOVFYuL13J
- TLSH T1D8433A647D76E8A5D50A193C0C2AEFDE0EA4FDC5DE1996277BF0FB8F883482B4814110
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{2F519BF2-C697-59F8-8F6A-1E19509CE66B}
- Size 36KB
- SHA256 813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1
- MD5 8aaad0f4eb7d3c65f81c6e6b496ba889
- SHA1 231237a501b9433c292991e4ec200b25c1589050
- SHA512 1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62
- SSDEEP 768:XmmmmmmmmmmmmmmmmmmmmmydiXjPJdKQ7ai3ZigbmY9//JD9UZ99tS0FVGn4YEbR:fig1Z
- TLSH T1B7F2DF61F616A589F74B58B159ACCCA080D63C7D8EF0051CF2EBB71E42B336205A9E5A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
- Size 36KB
- SHA256 e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e
- MD5 406347732c383e23c3b1af590a47bccd
- SHA1 fae764f62a396f2503dd81eefd3c7f06a5fb8e5f
- SHA512 18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7
- SSDEEP 384:/6Jd1uvjolavQWWo/tALCDK5Ja+ltg0aP+RO0:yJdkvMAYWZtsJawzar
- TLSH T12DF2F896341C5374FA7498372A3697A31B20EDBEDAE43A88D7D4B41F38D342415278F6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{6D809377-6AF0-444B-8957-A3773F02200E}_VideoLAN_VLC_VideoLAN Website_url
- Size 36KB
- SHA256 136808af50ee73df9befd76f7aca21765782565b0095227c5a287f3be0b5ef3c
- MD5 bad093419be1135cfe9694ea77088c78
- SHA1 76204c7ca72cf666add9c9931389d635c82e8af0
- SHA512 3b5cb7f80d7cbc557b5a32a995cd607257ac8e56af935ce6f64c54ba1f311a65ef00c69c69047b6eb7bb678c2b1bc0a3c37548aef417ea49e414e1a34bcf651d
- SSDEEP 48:jDlmj1hraax2DvfG+ohTrNAg4eBDAudJ4hKO2I7dQOggBYiiqD1yB72G6nBRz9iz:jDlU1hUol9onbdaa/aarIkb
- TLSH T172F2D25DEB27BCE8E92E53F8757158273F56D543A4FD69AD00A762221C3824210ABCCF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ac3fb13-7e39-42eb-9ad1-3cb9d2b9a06f}\0.0.filtertrie.intermediate.txt
- Size 30KB
- SHA256 998772a6e01abdea69cf6cc6c9dd18be6232009e341354005b8f317d55eda301
- MD5 a1819453b7b750c26e92ad7cba12dba8
- SHA1 dac2f1c9a122c73ac166532a541b9c1318df4e5c
- SHA512 82df0d9b9cc1c9ea61445e3e0aa727eb93c96a0a51704418f9924405346efad9a21fdb6366627edad84651320f3b11325223147869951158ad9c62da7f4eaf3d
- SSDEEP 768:gMP1ewchqEZDgApzxdG6yMVyNm/aFHlDik2p9XdHjF:zQ9R1z2WVyNQ+hn2pJdjF
- TLSH T1E6E2FD32C631A1AB74B15AE46F078352BC41C44697C7AA5217ADBCE4E0C90B1CFA77BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ac3fb13-7e39-42eb-9ad1-3cb9d2b9a06f}\0.1.filtertrie.intermediate.txt
- Size 5B
- SHA256 8e1e6a3d56796a245d0c7b0849548932fee803bbdb03f6e289495830e017f14c
- MD5 34bd1dfb9f72cf4f86e6df6da0a9e49a
- SHA1 5f96d66f33c81c0b10df2128d3860e3cb7e89563
- SHA512 e3787de7c4bc70ca62234d9a4cdc6bd665bffa66debe3851ee3e8e49e7498b9f1cbc01294bf5e9f75de13fb78d05879e82fa4b89ee45623fe5bf7ac7e48eda96
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ac3fb13-7e39-42eb-9ad1-3cb9d2b9a06f}\0.2.filtertrie.intermediate.txt
- Size 5B
- SHA256 d65b6a3bf11a27a1ced1f7e98082246e40cf01289fd47fe4a5ed46c221f2f73f
- MD5 c204e9faaf8565ad333828beff2d786e
- SHA1 7d23864f5e2a12c1a5f93b555d2d3e7c8f78eec1
- SHA512 e72f4f79a4ae2e5e40a41b322bc0408a6dec282f90e01e0a8aaedf9fb9d6f04a60f45a844595727539c1643328e9c1b989b90785271cc30a6550bbda6b1909f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ac3fb13-7e39-42eb-9ad1-3cb9d2b9a06f}\Apps.ft
- Size 41KB
- SHA256 b8374a4dfdb67379ad2dbcbc8ac022355aa71a6f665784d510b2ff7a8df15163
- MD5 23910e25bbd723c35c6302dfad660874
- SHA1 6e3aeedae807221c0294d399540c3cbf3f5482df
- SHA512 83ef8220ea49abe3ca8d200944fa70a3489a83a11d363b38861a5c6c0df610cf5f3e1de52d010397f068da9dc00a0c5a340e461ab9a4a3c8932a95aec855ee35
- SSDEEP 768:uGOf4Z/ohhi1JWO++Vz9JWxXVoVPPPw7M/W187B:uGy4Z/ohhi1sO++B9JWNVoVPPPw7M/gk
- TLSH T1C613F9D94B39972FF30A5F394692A435DAE427B0A1D9F2C39CD434A81DCD5A20F3C64A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{5ac3fb13-7e39-42eb-9ad1-3cb9d2b9a06f}\Apps.index
- Size 1.0MB
- SHA256 bf7e9ffa4733d214ab48493802e5bcdc878f8d32688c0379255a5bfdae3850d5
- MD5 ac0db37743b95375d20d717987e96a3d
- SHA1 6b4421bdfea386d2cdfd089db76fbb419fb65d34
- SHA512 ad5eb1a11613176342cb4c943da71ef8bb250437dcc806d0f1d40955934be33de21a4e061f812bf7d407e42671a64a84e541e1f2cb3a012bbc6e8ae016e5f9a9
- SSDEEP 24576:AoLr7YfoyFxz8GfoLr7YfoyFxz8GMRXS:AMwf1xz8GfMwf1xz8G
- TLSH T1C935E0096B60622BE4259BB42FC32F163FBFC52953EB13AB9B35013C1CB43557E5942A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache134161995530608202.txt
- Size 83KB
- SHA256 28bf6464a3e8ff30ec7a9a6d14d9d98667f03820633df69f78df4c6e419c73e5
- MD5 ceb2a92a63e51facabfb8b7a05456052
- SHA1 68c2dd06ca7d0f3a5d50937501a2c2c6992305c2
- SHA512 e005414faac3137f92794107ccd51b89178973dcd66c60d24eaf6374aa69aa93039fecab4a0b969c74811fc9dfc8ea6c07ba8f8f34ed4931ae96eee2401dfb30
- SSDEEP 384:S/v4/n5Y/yGL/aJU/gH2/HZ/Mx/h8r/hpm/ZVN/EAw/en/Mgu/NV8/Cz22/1WE/y:vYTPqdY8jp
- TLSH T1BC83B3A53280CBF3317966A0BCDDE525E17926B1E0A88F4061FA9613FD5ADCD62313D3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\LimitResolve.ppt
- Size 313KB
- SHA256 8d7d2da6840b36743840d8c8c4720294265e56acb42b955c94b02da435a7cdc4
- MD5 24bae8196113015f79a4d2e009e0e8d5
- SHA1 380562ea3c6abe1a6b26d64d1cedea0a98e626bf
- SHA512 ed7aeb6b73ad1e086c8711217ec86a23297210f55d0f7029e9198afda224a55a4467947289a92fc66677845e782962557ed2ec87b39be9c8fd82a10fcf75fcd9
- SSDEEP 768:m7BGV95hIG1/d49gsCDspDzXjQ+qaECAa5:mcJ1/m9YIpXjQ+qa0g
- TLSH T151640B8447C164F0D151BC39B841FA338375CAD06C6B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\PopDeny.xlsx
- Size 47KB
- SHA256 a11fb9d293f0de7c40681476e5fd71d507e24fae9b5360051b3812be1772d219
- MD5 a662702d8dd2bdf0a743cdd9d25741d8
- SHA1 f9847a0bd71f12f7d03d4e5d73de151621539cbe
- SHA512 3d05f04bb8e38194a02a8347562622d5acaff4829e47a5881a0ad53883f6a8fd0f67d236d4a1b084e8df8b2497318f8ff747dceae957c2ac2e54acef20ea8d42
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkra6:m7BGV95hIG1/d49gsCDs+
- TLSH T19923A78847C164F09151BC09B845FA378375CEC07C6B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\ReceiveFind.jpg
- Size 663KB
- SHA256 b62adb594ca6d5b3f3670d322e1aa5c0950984b367ff3b5093ac0db5c5ac18dc
- MD5 d960a651b18a1f57d2d19613050803c7
- SHA1 a3b6f008b06fc84e0dcb273f6ec3e92a34c39830
- SHA512 98e06140550b1a90d9ab258ad8b8f20b396d003025f35eee270f6fab4cc579a5593254bc0ed2c9ae3ba1d550e01824e9b2adf3c979ee3ba23642777f0bba21e7
- SSDEEP 1536:mcJ1/m9YII4wNw0tRJ73ghdWZ6J5oMDmj/VMkdK7j871EEN+PLdrboS51thjAs:mcPqROd3qW65PE/VTsgRN0LdxntD
- TLSH T142E4D38847C264F0D110BC39B841FA378374CAD46C2B56BEE857A28DB455AAAF0F51F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\StepBlock.gif
- Size 496KB
- SHA256 02322b15a44e53feb51cfae8b870bc162d3d89721d19cc46a9971773ca815b9e
- MD5 60276199753543c5833c501efdfd076a
- SHA1 cc1e232bb1675f99e1f0b2644d06e364ea402629
- SHA512 0cc400f88c0b9664ae02f74e227ec340e3be992c8a2c5aa8b51df15fbf7806e19cbce31269e74768b7e2109c9596f4e7930ce3f8193ebc8dfd9e07fa4638fc8a
- SSDEEP 3072:mcPqRks4LCnvVaagf56wCY+xhyxEUXOw/wnThoYnHYtsCf1cQaYbpJTrW:5qRks4GnNp9wQhyxrewYScCqgk
- TLSH T111B4598447C164F0D150AC3AB841FA338375CAC42C6B56BEE953A68EB415E6AF0F61F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Music\Slap1.vbs
- Size 46KB
- SHA256 ec17f950f6ee9c0c237d93bc0b766aa6e2ab458c70320b534212043128177b51
- MD5 99ec3237394257cb0b5c24affe458f48
- SHA1 5300e68423da9712280e601b51622c4b567a23a4
- SHA512 af2394d18f672def6d5d7081def759093759205aac0390ca03591c58c15a02e463a68b583b6fc28ef1368922b4bd5f9072d570ee97a955250a478cdb093500cb
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraB:m7BGV95hIG1/d49gsCDsl
- TLSH T11B23A78847C164F09150BC09B845FA378375CEC07C6B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\Acrobat Reader DC.lnk
- Size 49KB
- SHA256 84209bb60aaa11f9214c239cc737b3ecffa634df62ff94e98dc567b2a12b801f
- MD5 a4521e5a9cbaf245da2d1f157e227de7
- SHA1 e631e3d1c32f513617a178ad4182896ecfc8b053
- SHA512 694bff54070ce7578d91209ad52fa728946d7c15fdebc7d2dff92123a08d13962171cbdf0bbbe2d853007737f2fb8d887d5c56ada811d74af17c0e14548d0180
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraa:m7BGV95hIG1/d49gsCDsE7n
- TLSH T12833A88847C164F19151BC0AB845FE378375CAC07C2B567EE953A28EB015A6AF1F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\Firefox.lnk
- Size 48KB
- SHA256 b4a74d6f19c97f410f3eec80540cf293528110ba2a7e714efc09de321866f246
- MD5 21b8b8d288178977409891729291d59a
- SHA1 a6b09e4a6a84d19a6acff35591357e58cea8abac
- SHA512 b3337f7428c593dd27213bd94dcecc618be82058812786a5d4e4f1138087386dcd1c61ab694d555a83a5b6a2da27b5e03fb8f4698fed6ed4277fc2a55633f846
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkraI:m7BGV95hIG1/d49gsCDsh72
- TLSH T12223A78847C164F09151BC09B845FA378375CED07C2B56BEE953A28EB015A6AF1F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\Google Chrome.lnk
- Size 49KB
- SHA256 e3322e244ad23b14a61c2653de07f3df8701b4503e2ae521163b39353c49e23e
- MD5 9ea620be37ea35e1aa130f1b61946b99
- SHA1 631bcf12a9ca87d237d5527b1709c2feb40b4a85
- SHA512 593a9f61e4a55e6e57057b856e07754baa6e5e6d9c34d63a94af732411024b50291c7e88a2ea582589a32db063daa1648ab3702d753650582ed1b05973515a47
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkrae:m7BGV95hIG1/d49gsCDsR70
- TLSH T17933B88847C164F19151BC0AB845FE378375CAC07C2B567EE953A28EB015A6AF1F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Desktop\VLC media player.lnk
- Size 47KB
- SHA256 4cf95a4089e96d8716284a68edc129b8fc99a751da1adf4bdaef79c43f9c40a0
- MD5 e10315ca101783b440bcf99b4fe6495b
- SHA1 50b80ee936d79cd85c3ee79ddcb0a436b22a481d
- SHA512 5fa76743a6daccdf76b00aacf7f028f1f1e44f4b3637fae3a7b4c3fd3095843566665dda8d89142f029b93711dc1c619040a7b9648d03298c949ef32e7445541
- SSDEEP 384:m71ThEgivcqpCghtpCAhDnVLri57VurlgRL1xCLI05ej+1DPpUo/i/vFCbWZkrao:m7BGV95hIG1/d49gsCDst79o
- TLSH T1FC23A88847C164F09151BC09B845FA378375CEC47C2B56BEE953A28EB415A6AF0F60FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Public\Ghostroot\KillDora.bat
- Size 482B
- SHA256 d6e7530e3879225bc21fc17859e5b5c71414375baac27bb361fd9162f4b49e0e
- MD5 4f08159f1d70d41bf975e23230033a0f
- SHA1 ea88d6fbdcf218e0e04a650d947250d8a3dfad40
- SHA512 958ac467e54d35c4ca5459853d661e49ea81efaa1ce3044114d577fcb757343a40ddb30b9f540cf9c100f05958a843bf312fa879c43bda7513643c824b318d6a
- TLSH T1DCF09E514FE28070C6501444E6CAEAB1612DF689F419C22161603848FC11419D97268A
- MD5 SHA1 SHA512 TLSH