salatstealer | 16e34d5b3836f196864a8efe804d8dcb5938801d29bed451a3b67dca6f7b0929

Analysis

max time kernel
117s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 22:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 4.5MB
Sample260702-2rfxyaf13t
SHA256 16e34d5b3836f196864a8efe804d8dcb5938801d29bed451a3b67dca6f7b0929
MD5 a4cd834ba9819b28bb0a45a90f34f45b
SHA1 8e36e4e662812bec78ba97cdb43960743efc2bad
SHA512 0181d28456589ece81e2b5281accb9bcfa483e4e26cf43cae7da42cc7b91bbcb306b368671f662381ee13248196f224bc0ca2dea373b85e2dc54f01d081a2541
SSDEEP 49152:RHOlsXUMuthG59/72yB08wlTPv9RD+Y1qEkvom1UYRos6lcEutlnuAcxvTdVIrCB:kLIGKwp39GEkv1ZKe7nuACbdx9oefA4
TLSH
T1B926E1037BFEB05AEA7B97B4947462814665FC774D51808E31CD048B4F9BA407EBC2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware credential_access defense_evasion discovery salatstealer persistence ransomware spyware stealer trojan upx

Malware Config

Signatures

Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
stealer salatstealer

Detect SalatStealer payload 28 IoCs

resource	yara_rule
behavioral2/memory/1016-42-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-46-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-41-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-43-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-44-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-45-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-47-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-48-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-49-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-50-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/1016-57-0x00000000037A0000-0x00000000043FA000-memory.dmp	family_salatstealer
behavioral2/memory/3816-104-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-105-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-108-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-109-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-107-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-252-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-280-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-281-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-282-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-283-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/3816-300-0x0000000003030000-0x0000000003C8A000-memory.dmp	family_salatstealer
behavioral2/memory/5008-342-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer
behavioral2/memory/5008-344-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer
behavioral2/memory/5008-343-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer
behavioral2/memory/5008-341-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer
behavioral2/memory/5008-346-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer
behavioral2/memory/5008-345-0x0000000003B70000-0x00000000047CA000-memory.dmp	family_salatstealer

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	powershell.exe

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
23	4644	powershell.exe
24	4644	powershell.exe
25	4644	powershell.exe
26	4644	powershell.exe
27	4644	powershell.exe

Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
3816	explorer.exe
5008	explorer.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
credential_access stealer

Credentials In Files
T1552.001
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	explorer.exe
File opened (read-only)	\??\F:	explorer.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\Recovery	ReAgentc.exe
File opened for modification	C:\Windows\SysWOW64\Recovery\ReAgent.xml	ReAgentc.exe

UPX packed file 33 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1016-22-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-40-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-42-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-46-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-41-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-43-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-44-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-45-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-47-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-48-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-49-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-50-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/1016-57-0x00000000037A0000-0x00000000043FA000-memory.dmp	upx
behavioral2/memory/3816-85-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-103-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-104-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-105-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-108-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-109-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-107-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-252-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-280-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-281-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-282-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-283-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/3816-300-0x0000000003030000-0x0000000003C8A000-memory.dmp	upx
behavioral2/memory/5008-321-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-342-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-344-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-343-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-341-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-346-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx
behavioral2/memory/5008-345-0x0000000003B70000-0x00000000047CA000-memory.dmp	upx

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft.NET\718ecc54-0fa5-6d43-44fc-72638204540f	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft.NET\wininit.exe	file.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe	explorer.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	ReAgentc.exe
File opened for modification	C:\Windows\Logs\ReAgent\ReAgent.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	ReAgentc.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	ReAgentc.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ReAgentc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	explorer.exe

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a45c254e-df1c-4efd-8020-67d146a850e0}\0011	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Capabilities	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0002	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	explorer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	explorer.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	explorer.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000\Software\Microsoft\Internet Explorer\Main	explorer.exe

Modifies registry class 38 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\client.cbs	SearchHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{7CF56288-4A62-4EC2-A8F1-0408F9267E20}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "23"	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total	SearchHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1086369643-1618123105-2567081378-1000\{7432B08A-164C-49F5-8DA5-C5EBA89084E0}	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs\Total = "56"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoftwindows.client.cbs	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\client.cbs	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoftwindows.client.cbs\ = "56"	SearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "23"	SearchHost.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.startmenuexperiencehost_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	StartMenuExperienceHost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	StartMenuExperienceHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\MuiCache	SearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1086369643-1618123105-2567081378-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Explorer\DomStorageState	SearchHost.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

pid	Process
1016	file.exe
1016	file.exe
1016	file.exe
1016	file.exe
1572	explorer.exe
1572	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
4644	powershell.exe
4644	powershell.exe
4644	powershell.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe
3816	explorer.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeShutdownPrivilege	1572	explorer.exe
Token: SeCreatePagefilePrivilege	1572	explorer.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	3816	explorer.exe
Token: SeIncreaseQuotaPrivilege	4644	powershell.exe
Token: SeSecurityPrivilege	4644	powershell.exe
Token: SeTakeOwnershipPrivilege	4644	powershell.exe
Token: SeLoadDriverPrivilege	4644	powershell.exe
Token: SeSystemProfilePrivilege	4644	powershell.exe
Token: SeSystemtimePrivilege	4644	powershell.exe
Token: SeProfSingleProcessPrivilege	4644	powershell.exe
Token: SeIncBasePriorityPrivilege	4644	powershell.exe
Token: SeCreatePagefilePrivilege	4644	powershell.exe
Token: SeBackupPrivilege	4644	powershell.exe
Token: SeRestorePrivilege	4644	powershell.exe
Token: SeShutdownPrivilege	4644	powershell.exe
Token: SeDebugPrivilege	4644	powershell.exe
Token: SeSystemEnvironmentPrivilege	4644	powershell.exe
Token: SeRemoteShutdownPrivilege	4644	powershell.exe
Token: SeUndockPrivilege	4644	powershell.exe
Token: SeManageVolumePrivilege	4644	powershell.exe
Token: 33	4644	powershell.exe
Token: 34	4644	powershell.exe
Token: 35	4644	powershell.exe
Token: 36	4644	powershell.exe
Token: SeIncreaseQuotaPrivilege	4644	powershell.exe

Suspicious use of FindShellTrayWindow 54 IoCs

pid	Process
1028	sihost.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe
1572	explorer.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2956	StartMenuExperienceHost.exe
2276	SearchHost.exe
1572	explorer.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 3816	1016	file.exe	90
PID 1028 wrote to memory of 1572	1028	sihost.exe	95
PID 3816 wrote to memory of 4644	3816	explorer.exe	102
PID 3816 wrote to memory of 5008	3816	explorer.exe	104
PID 4644 wrote to memory of 3996	4644	powershell.exe	107

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1016
- C:\Users\Admin\AppData\Local\Mozilla\explorer.exe
  C:\Users\Admin\AppData\Local\Mozilla\explorer.exe
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3816
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe
    3⤵
    - UAC bypass
    - Badlisted process makes network request
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4644
  - - C:\Windows\SysWOW64\ReAgentc.exe
      "C:\Windows\system32\ReAgentc.exe" /disable
      4⤵
      Drops file in System32 directory
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\explorer.exe" -
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5008

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Enumerates connected drives
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1572

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2956

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2276

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC
1⤵
PID:1552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 935B
SHA256 dc550a2a9c25e080a671edc30983361f7bfa4f4caba514e34e182cf9e8cd6728
MD5 bd363f63d995b50a10c332d487fdba22
SHA1 fdaf79835f4fc94d4f2e9eee0932afcd847dc680
SHA512 d77b7a6b6b9dd3f0c9200f228a0f8fb8fa97223795842ea79c562ecddcb637d936acbf1a7781d514c0045fcb47c91bc48efca359b9d22dc83767cddcde932628
TLSH
T1F511D258302DB3F10DC1EE3154E97E7A325E791EBC1E38A51532E1C883CDC6ABA858E5
MD5 SHA1 SHA512 TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 1KB
SHA256 d991a39e96c90c2a4b59bf4b5b23795f6a15f7d0ef2bd62e2e83cc5ab4f99b1f
MD5 84f78c537ee14c65bf4eea5daf82d4d2
SHA1 4d738555011638ee7c63637846802db6888cb24a
SHA512 7e7832af045157d00287eb40e1cb833e5b6a46a201dd15ff2b4d9f25e769d11025abed6c0802796ccbac509a7f8d2539feedba448854ef2269595e582a9f4804
TLSH
T18C11E4483029B3F50CC1EA3194D97B7A325F751E7C0E38A51532E0C893CDCBABA888E5
MD5 SHA1 SHA512 TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 4KB
SHA256 c178b5ecd6b02165c0d9e109cf3bd0a46ff4bb8f073125f7ffc42344649efacf
MD5 b4fd587fb1d9f1a16accde92ef7c503d
SHA1 263966878cfd91b66793e03f268a15a08513d40b
SHA512 45a55710777f5faacf348b94625fc2e83d7e54cfcceaa8ab7024773ac6b0c22ef6da6136e7266a13192bd8517388cf677b52e120e3b4a9036ebde2d8a58b145f
SSDEEP 48:nmujEqLWSIJhuB4BnYlpmujEqLWFrIJhuB4BnY3GmujEqLWIIJhuB4Bu:nB9CSIXui4B9CFrIXuiEGB9CIIXuiu
TLSH
T1E581D1583039B3F50CC4EA3154D43A7E325F755E7C5E38A90532E1C893CDC6ABA888E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 4KB
SHA256 a0556df67ca3e663af63b197100d1c573f5ac5f3ed8bf388e7ca6f4c1d80a84d
MD5 fc540e28ccbe08bb744df5a02ef2b7ef
SHA1 03f606b31586ba44bf7c9bbb1f1ab01e41bbc526
SHA512 6cdad9cb65c1f8d4832992bdffaa935be07ad66291074a325ee6b70a553758f303af580ef9b4135f4bafeaee990ac58ba476303cabd965cd0d1f0397a5208fd5
SSDEEP 48:nmujEqLWSIJhuB4BnYlpmujEqLWFrIJhuB4BnY3GmujEqLWIIJhuB4BnY6:nB9CSIXui4B9CFrIXuiEGB9CIIXuiZ
TLSH
T1DA91CF583039B3F11DC8EA3154D43ABE325F759E7C5E38A94532E1C892CDC6AB6C88E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 1KB
SHA256 c678a60a604785f24398c36d1dd0c4e2cc7449ad4aa0af0994f6fdb2bdc3db9d
MD5 7bc2e65640a427e28015b3a23244d5ed
SHA1 c04a65e0a33e9c4b962db9abc0a8f31fe939b936
SHA512 ac6b7da6d87344bcafb53868cf1d62d3e56c74d70c22bf2051f154a21c3b3f03c5253ea40fba1080c70b0b9fbded851982747ee4e50a025a267ea1bb03f4f8fb
TLSH
T16931D1583038B3F11CC8EA3554943ABE325F759E7C4E38A94536E1C892CCC6AB6C48E5
MD5 SHA1 SHA512 TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 1KB
SHA256 9c7783f95c8abbf32764f5a9ae0f50876b1fb959edba806e26683ddcf903990d
MD5 de818b7bd0f95cf749c6e7f60f9407c4
SHA1 e06d80267d189fc04534c7f75940a052a04451e5
SHA512 76bd396446dc4f46ea88cacf872326f28618fed0333d7449f7a24ae860aa4dff73d59c75ce2496cd837be110433f3fd7bf94066d67b72e4592f52e59cfbf1826
TLSH
T12731D1183038B3F11CC4EA3154943ABE325F755E7C0E38A94532E0C892CCC7AB6C88E5
MD5 SHA1 SHA512 TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 2KB
SHA256 1b50f0850033eb87adef38c4b03b9b941d2e21b926660233e97500000e86bbc9
MD5 805c3eb0fae7b028b4e0350f01268dfd
SHA1 e48dc6401d9bb4f935b283b827da0633d4d29e6c
SHA512 a4e4672060ef9f896a052bd15b8ee8f331ae9cae4569e57915cb8d4e3781ac13fcecd50b4bf679da8e253c1f4dcb6e95273fcbb70d78fd597097c97c514585bb
TLSH
T1E551D2583039B3F10CC5EA3194D43A7A325F755E7C5E38A90532E1C893CDC6ABA888E5
MD5 SHA1 SHA512 TLSH

Submit Download

svc_cb11690a.log

Path C:\ProgramData\svc_cb11690a.log
Size 2KB
SHA256 168efbb1d845fc152ab1a2aa415b2a238d6a88f9fdb0ff1d20cb496621c94ea7
MD5 1c15a1ed3f771e77e15ff9ebac350bb8
SHA1 6e7da6b0f9f22f2064c08a55210ad3b0045ae589
SHA512 757961bb94d85fab088fa3c6abd26b65272b47d5c4b1e56415ee12cc608982fe991e69b5a9e6a32eea994b8af0683c382268003967caa7c1857d480b156783f5
TLSH
T10D51D0583038B3F11CC8EA3154943ABE325F759E7C5E38A94532E1C892CCC6AB6C88E5
MD5 SHA1 SHA512 TLSH

Submit Download

explorer.exe

Path C:\Users\Admin\AppData\Local\Mozilla\explorer.exe
Size 4.5MB
SHA256 16e34d5b3836f196864a8efe804d8dcb5938801d29bed451a3b67dca6f7b0929
MD5 a4cd834ba9819b28bb0a45a90f34f45b
SHA1 8e36e4e662812bec78ba97cdb43960743efc2bad
SHA512 0181d28456589ece81e2b5281accb9bcfa483e4e26cf43cae7da42cc7b91bbcb306b368671f662381ee13248196f224bc0ca2dea373b85e2dc54f01d081a2541
SSDEEP 49152:RHOlsXUMuthG59/72yB08wlTPv9RD+Y1qEkvom1UYRos6lcEutlnuAcxvTdVIrCB:kLIGKwp39GEkv1ZKe7nuACbdx9oefA4
TLSH
T1B926E1037BFEB05AEA7B97B4947462814665FC774D51808E31CD048B4F9BA407EBC2BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 603B
SHA256 b346273b0f3e13afaa9f07d97248343c45a667a5e097d1198a449a4de187aebb
MD5 2510ff22aab74c2ba735738716005a2f
SHA1 306d676ad05de19254b82e221f183ff918e4902b
SHA512 b06c9137817610963efc14c36895253ac8c2eb5af5c9c5e3bdfa59fef8050d9827e4d250b571051c52d7141b4d69702cb0e23a14a114c3e163b1b5bdb2911f1f
TLSH
T1BEF0DC53D3E25125E023023D88A61BD27A33DB596FC7262B4540AE6C3E3B3002F494BC
MD5 SHA1 SHA512 TLSH

Submit Download

prep_Activatable Class_Hermes_perf.cache

Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\TempState\prep_Activatable Class_Hermes_perf.cache
Size 599B
SHA256 b536a3dae9ea5c69081f0491eed829e3b57e32401fdf49a63031bcd6b20e6fdb
MD5 658ab8c32d4cc5deb36ac5f63da4658b
SHA1 30c12cd871ff0c2c4098d794e9ae4f2540586813
SHA512 a73030c008ef3c2e274f11c90bfe79fa8ae402f76801c710bed8cc1ab1218a84858ea566b772be4bade8ef639a019c57d297028df15b64b3753482cf0f3c8f85
TLSH
T12AF05C83EB6A1B72C456123DC8EE56E47B31D1846EC11367A2107B1D3C2B7192D174BD
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1016-46-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-48-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-49-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-50-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-47-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-45-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-57-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-44-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-43-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-41-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-42-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-40-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/1016-22-0x00000000037A0000-0x00000000043FA000-memory.dmp

Download

memory/2276-130-0x000002B3801E0000-0x000002B3802E0000-memory.dmp

Download

memory/2276-151-0x000002B383C50000-0x000002B383C70000-memory.dmp

Download

memory/2276-131-0x000002B3801E0000-0x000002B3802E0000-memory.dmp

Download

memory/2276-142-0x000002B383A10000-0x000002B383A30000-memory.dmp

Download

memory/2276-143-0x000002B393E50000-0x000002B393F50000-memory.dmp

Download

memory/2276-132-0x000002B3801E0000-0x000002B3802E0000-memory.dmp

Download

memory/2276-176-0x000002B394660000-0x000002B394680000-memory.dmp

Download

memory/3816-85-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-103-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-108-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-104-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-107-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-252-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-280-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-281-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-282-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-283-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-105-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-300-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/3816-109-0x0000000003030000-0x0000000003C8A000-memory.dmp

Download

memory/4644-293-0x00000000062E0000-0x000000000663B000-memory.dmp

Download

memory/4644-350-0x00000000079F0000-0x0000000007A26000-memory.dmp

Download

memory/4644-290-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/4644-288-0x00000000057F0000-0x0000000005812000-memory.dmp

Download

memory/4644-287-0x0000000005990000-0x0000000005FDA000-memory.dmp

Download

memory/4644-362-0x0000000008E20000-0x00000000093DA000-memory.dmp

Download

memory/4644-284-0x0000000002D50000-0x0000000002D86000-memory.dmp

Download

memory/4644-339-0x0000000006250000-0x000000000626E000-memory.dmp

Download

memory/4644-340-0x0000000006680000-0x00000000066CC000-memory.dmp

Download

memory/4644-361-0x00000000080C0000-0x00000000080E2000-memory.dmp

Download

memory/4644-360-0x0000000007CB0000-0x0000000007D46000-memory.dmp

Download

memory/4644-359-0x0000000007C00000-0x0000000007C0A000-memory.dmp

Download

memory/4644-358-0x0000000007BA0000-0x0000000007BBA000-memory.dmp

Download

memory/4644-357-0x00000000081E0000-0x000000000885C000-memory.dmp

Download

memory/4644-349-0x0000000006B80000-0x0000000006BC8000-memory.dmp

Download

memory/4644-351-0x00000000704C0000-0x000000007050C000-memory.dmp

Download

memory/4644-356-0x0000000007A50000-0x0000000007AF3000-memory.dmp

Download

memory/4644-355-0x0000000007A30000-0x0000000007A50000-memory.dmp

Download

memory/4644-352-0x0000000070620000-0x000000007097B000-memory.dmp

Download

memory/4644-289-0x0000000005890000-0x00000000058F6000-memory.dmp

Download

memory/5008-346-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-341-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-343-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-344-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-342-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-321-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download

memory/5008-345-0x0000000003B70000-0x00000000047CA000-memory.dmp

Download