Analysis
- user interaction
yes - max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
02/07/2026, 23:52
General
- Target _Silent scripted installation.cmd
- Size 1KB
- Sample260702-3w2kwagx21
- SHA256 ad27b38f2e56226bfb720b722993eb1cbf752ff15dcd2d7c59ffae07cfa0a56d
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 3 IoCs
- A potential corporate email address has been identified in the URL: [email protected]
- Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Executes dropped EXE 8 IoCs
- Loads dropped DLL 50 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 3 IoCs
- Installs/modifies Browser Helper Object 2 TTPs 6 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Drops file in System32 directory 17 IoCs
- Drops file in Program Files directory 64 IoCs
- Drops file in Windows directory 9 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 27 IoCs
Processor information is often read in order to detect sandboxing environments.
- Kills process with taskkill 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 51 IoCs
- Modifies data under HKEY_USERS 41 IoCs
- Modifies registry class 64 IoCs
- Runs .reg file with regedit 2 IoCs
- Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 18 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of SetWindowsHookEx 17 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_Silent scripted installation.cmd"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42.64.exe"Internet Download Manager 6.42.64.exe" /SILENT /LOADINF="setup.ini"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-GE8UU.tmp\Internet Download Manager 6.42.64.tmp"C:\Users\Admin\AppData\Local\Temp\is-GE8UU.tmp\Internet Download Manager 6.42.64.tmp" /SL5="$170270,14238184,64512,C:\Users\Admin\AppData\Local\Temp\Internet Download Manager 6.42.64.exe" /SILENT /LOADINF="setup.ini"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll"4⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\idmfsa.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"4⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"4⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\idmantypeinfo.tlb"4⤵
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-MELOH.tmp\clean.bat" install"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\regini.exeregini "permdel.txt"5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F5⤵
- Modifies registry class
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\Wow6432Node\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\Software\Classes\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Wow6432Node\Internet Download Manager" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Internet Download Manager" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\Wow6432Node\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{7B8E9164-324D-4A2E-A46D-0165FB2000EC}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{5ED60779-4DE2-4E07-B862-974CA4FF2E9C}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{E8CF4E59-B7A3-41F2-86C7-82B03334F22A}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{9C9D53D4-A978-43FC-93E2-1C21B529E6D7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{6DDF00DB-1234-46EC-8356-27E7B2051192}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{D5B91409-A8CA-4973-9A0B-59F713D25671}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{07999AC3-058B-40BF-984F-69EB1E554CA7}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{0E5D391E-6A9E-101C-B6DF-F60A80231A87}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{202AFC46-6CDD-FE82-8C52-5990104C20F0}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{79873CC5-3951-43ED-BDF9-D8759474B6FD}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{E6871B76-C3C8-44DD-B947-ABFFE144860D}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{1CD20007-3B87-3336-1349-C7AE26E01D83}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{FC93A1AC-E200-CECA-C86C-DBF8D10831C6}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{3C463EC2-6181-C191-A8C9-A4D6D76B33DB}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{D189CA6A-1987-5A96-5095-E9C2B5B6702E}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{35699221-9155-D6DA-7068-8BC57602636B}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{AA5AED86-7BCC-6970-4C3F-E46AFF3EB48C}" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\Classes\CLSID\{37D6E00D-6482-C67D-CE0C-16E6D9E89B10}" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "FName" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "LName" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "Email" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "Serial" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "scansk" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "tvfrdt" /F5⤵
- System Location Discovery: System Language Discovery
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "radxcnt" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "LstCheck" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "ptrk_scdt" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "LastCheckQU" /F5⤵
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKCU\Software\DownloadManager" /v "CheckUpdtVM" /F5⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\system32\regsvr32.exe" /s /u "C:\Program Files (x86)\Internet Download Manager\IDMShellExt.dll"4⤵
- Loads dropped DLL
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv4⤵
- Executes dropped EXE
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf5⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r6⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o7⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP5⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP6⤵
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\idmBroker.exe"C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies registry class
-
-
C:\Windows\SysWOW64\taskkill.exe"taskkill" /f /im IDMan.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\is-MELOH.tmp\idmreg.reg"4⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
C:\Windows\SysWOW64\regedit.exe"C:\Windows\regedit.exe" /S "C:\Users\Admin\AppData\Local\Temp\settings.reg"4⤵
- System Location Discovery: System Language Discovery
- Runs .reg file with regedit
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr4⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
- Modifies registry class
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html5⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" https://www.internetdownloadmanager.com/support/installffextfrommozillasite.html6⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 1964 -prefsLen 27097 -prefMapHandle 1968 -prefMapSize 270279 -ipcHandle 2040 -initialChannelId {29abd8ef-ff48-4360-9ad8-1003c4b09088} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2420 -prefsLen 27133 -prefMapHandle 2424 -prefMapSize 270279 -ipcHandle 2448 -initialChannelId {1b403f77-d6e3-4e12-aa35-8980c0410d0f} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3860 -prefsLen 25164 -prefMapHandle 3864 -prefMapSize 270279 -jsInitHandle 3868 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3876 -initialChannelId {1547259c-61b1-46fc-a343-f692052e9e57} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3916 -prefsLen 27274 -prefMapHandle 3904 -prefMapSize 270279 -ipcHandle 4100 -initialChannelId {ca78d190-9bf9-4ce8-a771-db3ada68c5ed} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd7⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2616 -prefsLen 34773 -prefMapHandle 2804 -prefMapSize 270279 -jsInitHandle 2640 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 1604 -initialChannelId {b7106019-3868-4f01-92fc-fb104a8e3ece} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4696 -prefsLen 35010 -prefMapHandle 2896 -prefMapSize 270279 -ipcHandle 5072 -initialChannelId {15855877-bccb-40c6-bf4a-ebbd968a7983} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 2848 -prefsLen 35062 -prefMapHandle 5436 -prefMapSize 270279 -jsInitHandle 5448 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3248 -initialChannelId {eb2b0238-530b-4bf3-8437-df27936aaf41} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5688 -prefsLen 32952 -prefMapHandle 5692 -prefMapSize 270279 -jsInitHandle 5696 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5704 -initialChannelId {cf7a1b1b-8fd5-4df5-8f3c-cf6c0b48126f} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5872 -prefsLen 32952 -prefMapHandle 5876 -prefMapSize 270279 -jsInitHandle 5880 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5888 -initialChannelId {7011d920-610d-4840-87a6-a4bb4fa7ac99} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab7⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 6060 -prefsLen 32952 -prefMapHandle 6064 -prefMapSize 270279 -jsInitHandle 6068 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 6076 -initialChannelId {6fe92ae0-7581-4cd6-8592-9bd18cfe8258} -parentPid 2256 -crashReporter "\\.\pipe\gecko-crash-server-pipe.2256" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 10 tab7⤵
- Checks processor information in registry
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf6⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r7⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o8⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
-
C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
-
C:\Program Files (x86)\Internet Download Manager\IDMan.exe"C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /onboot4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\regsvr32.exeC:\Windows\Sysnative\regsvr32.exe /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"5⤵
- Loads dropped DLL
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"6⤵
- Loads dropped DLL
- Modifies registry class
-
-
-
C:\Program Files (x86)\Internet Download Manager\Uninstall.exe"C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\RUNDLL32.EXE"C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf6⤵
- Adds Run key to start application
- Drops file in Windows directory
-
C:\Windows\system32\runonce.exe"C:\Windows\system32\runonce.exe" -r7⤵
- Checks processor information in registry
-
C:\Windows\System32\grpconv.exe"C:\Windows\System32\grpconv.exe" -o8⤵
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" start IDMWFP6⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 start IDMWFP7⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"6⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"7⤵
- Loads dropped DLL
-
-
-
-
-
-
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{38fdd80b-3772-8b4b-aeaa-b17ce881b85f}\idmwfp.inf" "9" "4fc2928b3" "0000000000000114" "WinSta0\Default" "00000000000000EC" "208" "C:\Program Files (x86)\Internet Download Manager"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "00000000000000EC" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\grpconv.exegrpconv -o1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000114" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "8" "4" "C:\Windows\System32\DriverStore\FileRepository\idmwfp.inf_amd64_8b0ebbc2b4585464\idmwfp.inf" "0" "4fc2928b3" "0000000000000194" "WinSta0\Default"1⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Browser Extensions
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
IDMGetAll.dll
IDMGetAll64.dll
IDMIECC.dll
IDMIECC64.dll
IDMNetMon64.dll
IDMShellExt64.dll
IDMan.exe
215.bmp
is-6RCV5.tmp
is-ABSO7.tmp
is-M9TJN.tmp
is-PPSB3.tmp
is-F4SFB.tmp
is-N1J5U.tmp
is-8IM25.tmp
is-A471Q.tmp
is-A8FRU.tmp
is-EFVCA.tmp
is-NR3A4.tmp
is-JVF3K.tmp
is-9NNAF.tmp
is-CLRP1.tmp
is-DSQP9.tmp
is-EKES1.tmp
is-MC0AM.tmp
downlWithIDM.dll
downlWithIDM64.dll
idmantypeinfo.tlb
idmfsa.dll
9512A4488B00CC053350DAC32D417B4A35C11513
webext.sc.lz4
Internet Download Manager 6.42.64.tmp
ISTask.dll
VclStylesInno.dll
clean.bat
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
permdel.txt
tmpaddon
tmpaddon
idmcchandler2.dll
idmcchandler2_64.dll
data.safe.bin
data.safe.tmp
data.safe.tmp
data.safe.tmp
events
04473f8c-3ed3-4e90-bac4-f210aa9192d9
089ead55-3592-4225-9800-aed21e0f6025
0fd8b933-caf5-43b5-950c-e492d7aa339c
5c4caeef-1d8c-4a42-ab8e-df5b2f3c7136
d8f03a39-a954-44b5-9de5-e1f1b0e8c269
extensions.json
gmpopenh264.dll
gmpopenh264.info
manifest.json
widevinecdm.dll
prefs-1.js
prefs-1.js
prefs.js
recovery.baklz4
recovery.jsonlz4
3870112724rsegmnoittet-es.sqlite
idmwfp.inf_amd64_8b0ebbc2b4585464.ini
memory/1796-2055-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2448-1163-0x0000000000400000-0x000000000042B000-memory.dmp
memory/2448-1178-0x0000000000400000-0x000000000042B000-memory.dmp
memory/3024-52-0x00000000082F0000-0x00000000082F1000-memory.dmp
memory/3024-70-0x0000000008350000-0x0000000008351000-memory.dmp
memory/3024-39-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-56-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-57-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-59-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-60-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-62-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-63-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-65-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-79-0x0000000008380000-0x0000000008381000-memory.dmp
memory/3024-66-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-68-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-69-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-1060-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-71-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-72-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-74-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-80-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-81-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-83-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-84-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-82-0x0000000008390000-0x0000000008391000-memory.dmp
memory/3024-78-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-42-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-40-0x00000000082B0000-0x00000000082B1000-memory.dmp
memory/3024-37-0x00000000082A0000-0x00000000082A1000-memory.dmp
memory/3024-30-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-29-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-28-0x0000000008270000-0x0000000008271000-memory.dmp
memory/3024-26-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-27-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-25-0x0000000008260000-0x0000000008261000-memory.dmp
memory/3024-38-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-53-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-77-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-75-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-76-0x0000000008370000-0x0000000008371000-memory.dmp
memory/3024-87-0x0000000007F8E000-0x0000000007F8F000-memory.dmp
memory/3024-54-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-64-0x0000000008330000-0x0000000008331000-memory.dmp
memory/3024-58-0x0000000008310000-0x0000000008311000-memory.dmp
memory/3024-55-0x0000000008300000-0x0000000008301000-memory.dmp
memory/3024-51-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-50-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-1125-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-43-0x00000000082C0000-0x00000000082C1000-memory.dmp
memory/3024-48-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-47-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-23-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-45-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-44-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-41-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-73-0x0000000008360000-0x0000000008361000-memory.dmp
memory/3024-67-0x0000000008340000-0x0000000008341000-memory.dmp
memory/3024-61-0x0000000008320000-0x0000000008321000-memory.dmp
memory/3024-49-0x00000000082E0000-0x00000000082E1000-memory.dmp
memory/3024-46-0x00000000082D0000-0x00000000082D1000-memory.dmp
memory/3024-364-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-346-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/3024-95-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-35-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-17-0x0000000007BC0000-0x0000000007BD6000-memory.dmp
memory/3024-6-0x00000000022F0000-0x00000000022F1000-memory.dmp
memory/3024-94-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-93-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-92-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-91-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-89-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-90-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-88-0x0000000007DF0000-0x000000000810A000-memory.dmp
memory/3024-32-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-31-0x0000000008280000-0x0000000008281000-memory.dmp
memory/3024-34-0x0000000008290000-0x0000000008291000-memory.dmp
memory/3024-36-0x0000000008110000-0x0000000008250000-memory.dmp
memory/3024-33-0x0000000008110000-0x0000000008250000-memory.dmp
memory/4704-1579-0x0000000000400000-0x000000000042B000-memory.dmp
memory/5152-0-0x0000000000400000-0x0000000000417000-memory.dmp
memory/5152-1032-0x0000000000400000-0x0000000000417000-memory.dmp