b991d813fc1a1758d527be7c06554d31c9866c5dbea5b20daf2b8e4cf9d15d60

Resubmissions

01/08/2026, 18:11

260801-ws2m5sshrc7

01/08/2026, 18:05

260801-wpfaqsef475

Analysis

user interaction
yes
max time kernel
40s
max time network
57s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/08/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
release.zip
Size 66.5MB
Sample260801-ws2m5sshrc
SHA256 b991d813fc1a1758d527be7c06554d31c9866c5dbea5b20daf2b8e4cf9d15d60
MD5 682f53c9407858edcdb1d742f8efc8cf
SHA1 2311626ae6210ca31de110686be85987e05df36a
SHA512 d2fd08f6c694875e501bd87aec2bef397b5b001a505814c322e564905499abdfb496ab8bac51830c17e3f9fe945e0e717ae44ba70b79de78bb3b8175e911149a
SSDEEP 1572864:knW257yBaGQZRWCkNJJaEf2EVl2hAm6+864wfKpUtx1uTCrF:kn77cQZRWCCaLEV/G8rex1uT2F
TLSH
T1CCE733C1E74610794EF3AC5F469BA618868DFE4CB194B89457B2CD03C2DDE093ACE68D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence privilege_escalation ransomware

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion = 41004c00410053004b00410020002d0020003100300037003200300030003900000034002e0036002e003500000041006d00650072006900630061006e0020004d006500670061007400720065006e006400730020002d0020003400300032003800450000000000	regedit.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Modifies system executable filetype association 2 TTPs 36 IoCs

persistence

Modify Registry

T1112

Change Default File Association

T1546.001

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\EditFlags = 30040000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command\ = "%SystemRoot%\\System32\\NOTEPAD.EXE %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\edit\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command\ = "%SystemRoot%\\System32\\NOTEPAD.EXE /p %1"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\DefaultIcon\ = "%SystemRoot%\\System32\\imageres.dll,-68"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"%1\" %*"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\Extended	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility\ = "{1d27f844-3a1f-4410-85ac-14651078412d}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\PropertySheetHandlers\ShimLayer Property Page	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\ = "Windows Batch File"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\HasLUAShield	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\ = "@shell32.dll,-50944"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\SuppressionPolicyEx = "{F211AA05-D4DF-4370-A2A0-9F19C09756A7}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command\DelegateExecute = "{ea72d00e-4960-42fa-ba92-7792a7944c1d}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\Compatibility	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runasuser\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\DropHandler\ = "{86C86720-42A0-1069-A2E8-08002B30309D}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\print\command	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\ContextMenuHandlers\ = "Compatibility"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\FriendlyTypeName = "@%SystemRoot%\\System32\\acppage.dll,-6002"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shellex\{8895b1c6-b41f-4c1c-a562-0d564250836f}\ = "{1531d583-8375-4d3f-b5fb-d23bbd169f22}"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\runas\command\ = "%SystemRoot%\\System32\\cmd.exe /C \"%1\" %*"	regedit.exe

Checks processor information in registry 2 TTPs 64 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Previous Update Revision = 0000000021000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet = "1025196031"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\FeatureSet = "1025196031"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Revision = 0000000021000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\VendorIdentifier = "GenuineIntel"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Previous Update Revision = 000000001c000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Platform Specific Field 1 = "2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Component Information = 00000000000000000300000000000300	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Update Revision = 0000000021000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Previous Update Revision = 0000000021000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Platform Specific Field 1 = "2"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status = "0"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz = "3392"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Platform Specific Field 1 = "2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Update Status = "6"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Platform Specific Field 1 = "2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\VendorIdentifier = "GenuineIntel"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Platform Specific Field 1 = "2"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision = 000000001c000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Revision = 0000000021000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz = "3392"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Component Information = 00000000000000000700000000000700	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\FeatureSet = "1025196031"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\FeatureSet = "1025196031"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\Previous Update Revision = 000000001c000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Platform Specific Field 1 = "2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Previous Update Revision = 0000000021000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Update Status = "0"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Update Revision = 0000000021000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier = "GenuineIntel"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet = "1025196031"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz = "3392"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier = "GenuineIntel"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz = "3392"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Component Information = 00000000000000000200000000000200	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString = "Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\Platform Specific Field 1 = "2"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Update Revision = 0000000021000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz = "3392"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 = "2"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz = "3392"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\Update Revision = 0000000021000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision = 0000000021000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\Update Status = "0"	regedit.exe

Enumerates system info in registry 2 TTPs 64 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\7	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\7\Component Information = 00000000000000000700000000000700	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\3\Identifier = "PCI"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\4\Identifier = "PCI"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Component Information = 00000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\5	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\6\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data = 01000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\4\Component Information = 000000000000000000000000ffffffff	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Capabilities = "230565"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information = 280000000000000000000000ffffffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct = "B75"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "OEM"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\2\Component Information = 00000000000000000200000000000200	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\5\Configuration Data = ffffffffffffffff0000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\6\Component Information = 00000000000000000600000000000600	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5\Identifier = "PCI"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorRelease = "255"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Configuration Data = ffffffffffffffff0000000002000000050000000c0000000000000000000000000000000000ffffffff0000ffff01000500000000000000000000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\7\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\4\Component Information = 00000000000000000400000000000400	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier = "PCI"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\3\Configuration Data = 05000000010000000000000000000000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\6\Identifier = "PCI"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease = "6"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion = "Ver:1.41"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate = "09/01/2021"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3\Component Information = 00000000000000000300000000000300	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier = "AT/AT COMPATIBLE"	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BootArchitecture = "17"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information = 000000000000000000000000ffffffff	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMajorRelease = "4"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data = 05000000000000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\5\Configuration Data = 05000000030000000000000000000000	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\6\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer = "OEM"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\5\Identifier = "Intel64 Family 6 Model 58 Stepping 9"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data = 01000000000000000000000001000000050000000800000000000000000000000000000000000000ffff0000	regedit.exe
Set value (str)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier = "ACPI BIOS"	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\3\Component Information = 000000000000000000000000ffffffff	regedit.exe
Set value (int)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease = "255"	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0001	regedit.exe
Key created	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\3	regedit.exe
Set value (data)	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\5\Component Information = 00000000000000000500000000000500	regedit.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{57154C7C-EDB2-3BFD-A8BA-924C60913EBF}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6504AFED-A629-455C-A7F1-04964DEA5CC4}\ProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions\FLC	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05A47EBB-8BF0-4CBF-AD2F-3B71D75866F5}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{102D1D13-BD88-435f-99C1-DE69F1886168}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{687e55ca-6621-4c41-b9f1-c0eddc94bb05}\VersionIndependentProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{6B831E4F-A50D-45FC-842F-16CE27595359}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{7071EC01-663B-4bc1-A1FA-B97F3B917C55}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{784215B4-0D2E-11D3-920A-00C0DF10D434}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8368958c-a3ec-491f-9b4d-18f3f8287ee2}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mpv2\ShellEx\{BB2E617C-0920-11D1-9A0B-00C04FC2D6C1}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.symlink\shellex\ContextMenuHandlers\{85cfccaf-2d14-42b6-80b6-f40f65d016e7}\	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{1fda955b-61ff-11da-978c-0008744faab7}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AVIFile\Extensions	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CID\0134d0f8-a62b-4f6f-a642-3f080b507e1f	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{00000303-0000-0000-C000-000000000046}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{083863F1-70DE-11D0-BD40-00A0C911CE86}\Instance\{D51BD5A5-7548-11CF-A520-0080C77EF58A}\FriendlyName = "File stream renderer"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2134da04-4faa-42ed-ada2-43707b4e1de1}	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mp3\PersistentHandler\ = "{098f2470-bae0-11cd-b579-08002b30bfeb}"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050f4e1-98b5-11cf-bb82-00aa00bdce0b}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{477A7D8E-8D26-3959-88F6-F6AB7E7F50CF}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2206CDB3-19C1-11D1-89E0-00C04FD7A829}\VersionIndependentProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8078DA75-F43F-341D-A00E-20D6D736415E}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{884e2062-217d-11da-b2a4-000e7bbb2b09}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8040703-2640-48B7-96CD-BC8108A4E8F1}\TypeLib	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ace575fd-1fcf-4074-9401-ebab990fa9de}\Control	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.cmd	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0AEA3667-1039-43ff-8D21-B1A162090671}\Version	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9E175B6D-F52A-11D8-B9A5-505054503030}\VersionIndependentProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C0AA9D93-2EF5-47FB-960C-F90FC644B48E}\VersionIndependentProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C100BEBC-D33A-4a4b-BF23-BBEF4663D017}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c2b94e6d-6ebd-44ee-aac1-eb809c984699}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c39b7f77-976c-4983-b888-dbdc948d5364}\InprocServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C5702CCD-9B79-11D3-B654-00C04F79498E}\TypeLib	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{43B07326-AAE0-4B62-A83D-5FD768B7353C}\Programmable	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{49638B91-48AB-48B7-A47A-7D0E75A08EDE}\Implemented Categories\{0DE86A54-2BAA-11CF-A229-00AA003D7352}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{884e2036-217d-11da-b2a4-000e7bbb2b09}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C100BEE2-D33A-4a4b-BF23-BBEF4663D017}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c99217e2-951d-40b6-b4e4-6af203dadf89}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CAA1B979-07A6-439C-A38C-2BE2B99C3B4A}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d23e6477-b104-4707-81cb-e1ca19a07016}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.jp2	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BDATuner.SystemTuningSpaces\CurVer	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{000C1090-0000-0000-C000-000000000046}\ProgId	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06210E88-01F5-11D1-B512-0080C781C384}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{24540EBC-316E-35D2-80DB-8A535CAF6A35}\Implemented Categories\{62C8FE65-4EBB-45E7-B440-6E39B2CDBF29}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2559a1f0-21d7-11d4-bdaf-00c04f60b9f0}\Instance\InitPropertyBag	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3050f3B3-98b5-11cf-bb82-00aa00bdce0b}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{722D0F89-B69C-4700-AE8C-4A44350E4876}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EAB99738-0ADF-4A53-856C-DE58AFDE7682}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{48E277F6-4E74-4cd6-BA6F-FA4F42898223}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{752438CB-E941-433F-BCB4-8B7D2329F0C8}\Elevation	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{884e2003-217d-11da-b2a4-000e7bbb2b09}\VersionIndependentProgID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8C40D44A-4EDE-3760-9B61-50255056D3C7}\Implemented Categories	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9cb233a5-a4a5-46b9-ab13-db07ce949410}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A4445657-BCB6-476E-8336-3A2ACD96E299}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ADOR.Recordset\CLSID	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{3E000D72-A845-4CD9-BD83-80C07C3B881F}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CD0938D-1AC1-49DE-AA04-F2C92D4A02D1}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{27171325-5F06-407C-AA8F-61154A674DE2}\InProcServer32	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{276C88CA-7533-4A86-B676-66B36080D484}	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B98A2BEA-7D42-4558-8BD1-832F41BAC6FD}\InProcServer32	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
3264	regedit.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\release.zip
1⤵
PID:4816

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1260

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\release\protected\test1.reg"
1⤵
- Checks BIOS information in registry
- Modifies system executable filetype association
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Runs .reg file with regedit
PID:3264