hxxps://www[.]sgic[.]co[.]kr/biz/ccp/index[.]html?p=CCPCST050301F01&url=https%3A%2F%2Fwww[.]sgic[.]co[.]kr%2Fbiz%2Fccp%2Findex[.]html%3Fp%3DCCPUTL010015F01

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	TEFSvrP64.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	TEFW_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	TEFW_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	TEFW_Installer.exe
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	TEFW_Installer.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 50 IoCs

pid	Process
1188	TEFW_Installer.exe
4532	TEFSvrP64.exe
3824	TEFWP.exe
4848	TEFWP64.exe
2260	raon_touchenex_Install.exe
4264	CrossEX_LocalService_Install.exe
2428	CrossEXService.exe
2920	ObCrossEXService.exe
4464	FFCert.exe
1204	Firefox_CertUtil.exe
4788	certutil.exe
2296	certutil.exe
3500	TEFW_Installer.exe
4644	TEFSvrP64.exe
3140	TEFWP.exe
1260	raon_touchenex_Install.exe
2300	TEFWP64.exe
4904	CrossEX_LocalService_Install.exe
4468	CrossEXService.exe
1904	ObCrossEXService.exe
2664	FFCert.exe
1864	Firefox_CertUtil.exe
708	certutil.exe
2604	certutil.exe
4004	TEFW_Installer.exe
1852	TEFSvrP64.exe
5032	TEFWP.exe
3424	TEFWP64.exe
1232	raon_touchenex_Install.exe
3480	CrossEX_LocalService_Install.exe
3952	CrossEXService.exe
2924	ObCrossEXService.exe
1388	FFCert.exe
1144	Firefox_CertUtil.exe
1964	certutil.exe
2244	certutil.exe
4548	TEFW_Installer.exe
3376	TEFSvrP64.exe
4944	TEFWP.exe
4152	raon_touchenex_Install.exe
2300	TEFWP64.exe
4408	CrossEX_LocalService_Install.exe
3368	CrossEXService.exe
3804	ObCrossEXService.exe
4768	FFCert.exe
2604	Firefox_CertUtil.exe
4276	certutil.exe
4720	certutil.exe
1456	TEFSvrP64.exe
4416	TouchEn_nxFW_Installer.exe

Loads dropped DLL 64 IoCs

pid	Process
2260	raon_touchenex_Install.exe
2260	raon_touchenex_Install.exe
4264	CrossEX_LocalService_Install.exe
4264	CrossEX_LocalService_Install.exe
4264	CrossEX_LocalService_Install.exe
4264	CrossEX_LocalService_Install.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
4788	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
2296	certutil.exe
4904	CrossEX_LocalService_Install.exe
4904	CrossEX_LocalService_Install.exe
4904	CrossEX_LocalService_Install.exe
4904	CrossEX_LocalService_Install.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
708	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
2604	certutil.exe
3480	CrossEX_LocalService_Install.exe
3480	CrossEX_LocalService_Install.exe
3480	CrossEX_LocalService_Install.exe
3480	CrossEX_LocalService_Install.exe
1964	certutil.exe
1964	certutil.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\CrossEXService = "C:\\Program Files (x86)\\iniLINE\\CrossEX\\crossex\\CrossEXService.exe"	CrossEX_LocalService_Install.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	\??\c:\windows\SysWOW64\JRWSKFW64.SYS	TEFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFWN64.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFW.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRWSK_DLL.dll	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\TEFScreen32.SYS	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\CKFW.exe	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\JRTDIFWN.sys	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\TEFW64.exe	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN364.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen32.SYS	TEFW_Installer.exe
File created	\??\c:\windows\SysWOW64\TEFWSetup.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW64.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN264.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\system32\license_info.conf	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.SYS	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN64.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.SYS	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN64.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFW64.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen32.SYS	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRWSKFW64.SYS	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFWP64.exe	TEFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFW.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFW.exe	TEFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFWN364.sys	TEFSvrP64.exe
File opened for modification	C:\Windows\system32\JRTDIFW64.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\SysWOW64\NPCKFW.dll	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.SYS	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP64.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN3.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRNDISFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen32.dll	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\TEFWP64.exe	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFWP64.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.dll	TEFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFWN3.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\system32\JRTDI98.vxd	TouchEn_nxFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFWN264.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN364.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP64.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRNDISFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRWSKFW.SYS	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFWP.exe	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW64.sys	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\system32\TEFScreen64.dll	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN.sys	TEFW_Installer.exe
File opened for modification	C:\Windows\system32\JRTDIFWN3.sys	TEFSvrP64.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP.exe	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN3.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\license_info.conf	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN364.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN264.sys	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFW.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDIFWN264.sys	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.dll	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRWSKFW.SYS	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\JRTDI98.vxd	TEFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFScreen64.SYS	TouchEn_nxFW_Installer.exe
File opened for modification	\??\c:\windows\SysWOW64\TEFSvrP64.exe	TouchEn_nxFW_Installer.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\vcsdk.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\scan.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\vcsdk.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\Firewall.ini	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\BDUpdateServiceCom.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\iniLINE\CrossEX\crossex\rootCA.crt	CrossEX_LocalService_Install.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\JRTDIFWold.sys	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSKFW.SYS	TouchEn_nxFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\Setup.cab	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\BDUpdateServiceCom.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSK_DLL.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSK_DLL.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\RaonSecure\TouchEn nxFirewall\TFMain64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\RaonSecure\TouchEn nxFirewall\TFMain.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP.exe	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\Setup.cab	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\clientsocket64.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\BDUpdateServiceCom.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\RaonSecure\bridge\CrossEX\touchenex\UnInstallCrossEX.exe	raon_touchenex_Install.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRTDIFW64old.sys	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\VcHttp.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRFW.dat	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRTDIFW32.SYS	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TFMain.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\JRTDIFWold.sys	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TouchEn_nxFW_Installer.exe
File opened for modification	C:\Program Files (x86)\RaonSecure\TouchEn nxFirewall\TFMain64.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP.exe	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFW.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSKFW64.SYS	TEFW_Installer.exe
File created	C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe.sig	CrossEX_LocalService_Install.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\scan.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\Setup.cab	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\clientsocket.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\JRTDIFW32.SYS	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\Firewall.ini	TouchEn_nxFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\clientsocket64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\scan.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\Setup.cab	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFW.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\BDUpdateServiceCom.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe.sig	CrossEX_LocalService_Install.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\TFMain64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\clientsocket64.dll	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSKFW64.SYS	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSK_DLL.dll	TouchEn_nxFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\RaonSecure\TouchEn nxFirewall\TFMain64.dll	TouchEn_nxFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\JRWSKFW64.SYS	TEFW_Installer.exe
File created	C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe	TEFW_Installer.exe
File opened for modification	C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe	TEFW_Installer.exe
File created	C:\Program Files (x86)\iniLINE\CrossEX\crossex\rootCA.crt	CrossEX_LocalService_Install.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\{79D068F5-40E4-3614-A683-E351DF40BEBD}\icon.ico	explorer.exe

Launches sc.exe 12 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4936	sc.exe
1640	sc.exe
3228	sc.exe
3000	sc.exe
3172	sc.exe
952	sc.exe
3348	sc.exe
3340	sc.exe
2244	sc.exe
3644	sc.exe
2548	sc.exe
1212	sc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies trusted root certificate store through registry 1 TTPs 5 IoCs

A root certificate was added, modified, or removed in the trusted certificate store registry paths.

defense_evasion

Install Root Certificate

T1553.004

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79\Blob = 030000000100000014000000dc2f16a0e1af8faf0d3e93eac9aca7315a409c792000000001000000b6030000308203b23082029aa003020102020101300d06092a864886f70d01010b05003070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f744341323020170d3138313031303038323831355a180f32303939313233313038323831355a3070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100c74641aea9b5c3ac70c760c8b9b4d913239c9f1f2ba22ec168ddf87c291a6f7bf65039a350a4df32666610daeef39f518c94566fb0883e95d5954bb6fa77fb741d85321d4779043dfae7530d23f0834bd602eac8380298c246d0ab9d8ad4c1b11fdfe8dac89f57872151fb07494e2611db05fd7a911b2072731304b583a100a8346d3e75aee2bc90fc82eda089b475919abc33f9c44b4d1642d059e6818d723c6a725bdbf3f1b0936580a6fe2cf8009d382e5e6bc1e8f16869c153d0cd1f58359761f250b8f2f28227acbb6d7467e60cc441618cf1805f4e5eccc4a0caf8b6b6f627e264f92ed3bcdde2899d7035145576c3d2e4b2f95ca5eb2bbaca8d0ea4d90203010001a355305330120603551d130101ff040830060101ff020100301d0603551d0e04160414baf05eca432879dc5a9fe9f563d90721fa1a504b300b0603551d0f040403020106301106096086480186f8420101040403020007300d06092a864886f70d01010b05000382010100c08cf619a76feef45d47324122595199e2825f963d4afdee811f2038e5d5fc369518cdb0fb4d0412499417a7f4f7308955370c7f1aa84a5806884b78817924ef7d5332214c70f0411d4434bdd009b6094fe5e1ec61a380058abfde0eb6f66f0727e74d6109266a36b2d563fdd9999d8eecd752271286e605247ef552ace03bb93550440002423e129308f4aeb1f416f33f8c4969abf2af6bcb33f5833e14aa51cb2194e9978cfe9f4158b2964faf0233841ddb09bac430b32981e65ef39611521e45b0188b549541d1188317fa287b987b9fc312613b63b218eafbe1d7152e175d58b313d67e59a3a691b73c0addf8eb2a2d8778392ff28b25faa6ff9145b080	CrossEX_LocalService_Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79\Blob = 030000000100000014000000dc2f16a0e1af8faf0d3e93eac9aca7315a409c792000000001000000b6030000308203b23082029aa003020102020101300d06092a864886f70d01010b05003070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f744341323020170d3138313031303038323831355a180f32303939313233313038323831355a3070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100c74641aea9b5c3ac70c760c8b9b4d913239c9f1f2ba22ec168ddf87c291a6f7bf65039a350a4df32666610daeef39f518c94566fb0883e95d5954bb6fa77fb741d85321d4779043dfae7530d23f0834bd602eac8380298c246d0ab9d8ad4c1b11fdfe8dac89f57872151fb07494e2611db05fd7a911b2072731304b583a100a8346d3e75aee2bc90fc82eda089b475919abc33f9c44b4d1642d059e6818d723c6a725bdbf3f1b0936580a6fe2cf8009d382e5e6bc1e8f16869c153d0cd1f58359761f250b8f2f28227acbb6d7467e60cc441618cf1805f4e5eccc4a0caf8b6b6f627e264f92ed3bcdde2899d7035145576c3d2e4b2f95ca5eb2bbaca8d0ea4d90203010001a355305330120603551d130101ff040830060101ff020100301d0603551d0e04160414baf05eca432879dc5a9fe9f563d90721fa1a504b300b0603551d0f040403020106301106096086480186f8420101040403020007300d06092a864886f70d01010b05000382010100c08cf619a76feef45d47324122595199e2825f963d4afdee811f2038e5d5fc369518cdb0fb4d0412499417a7f4f7308955370c7f1aa84a5806884b78817924ef7d5332214c70f0411d4434bdd009b6094fe5e1ec61a380058abfde0eb6f66f0727e74d6109266a36b2d563fdd9999d8eecd752271286e605247ef552ace03bb93550440002423e129308f4aeb1f416f33f8c4969abf2af6bcb33f5833e14aa51cb2194e9978cfe9f4158b2964faf0233841ddb09bac430b32981e65ef39611521e45b0188b549541d1188317fa287b987b9fc312613b63b218eafbe1d7152e175d58b313d67e59a3a691b73c0addf8eb2a2d8778392ff28b25faa6ff9145b080	CrossEX_LocalService_Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79\Blob = 030000000100000014000000dc2f16a0e1af8faf0d3e93eac9aca7315a409c792000000001000000b6030000308203b23082029aa003020102020101300d06092a864886f70d01010b05003070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f744341323020170d3138313031303038323831355a180f32303939313233313038323831355a3070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100c74641aea9b5c3ac70c760c8b9b4d913239c9f1f2ba22ec168ddf87c291a6f7bf65039a350a4df32666610daeef39f518c94566fb0883e95d5954bb6fa77fb741d85321d4779043dfae7530d23f0834bd602eac8380298c246d0ab9d8ad4c1b11fdfe8dac89f57872151fb07494e2611db05fd7a911b2072731304b583a100a8346d3e75aee2bc90fc82eda089b475919abc33f9c44b4d1642d059e6818d723c6a725bdbf3f1b0936580a6fe2cf8009d382e5e6bc1e8f16869c153d0cd1f58359761f250b8f2f28227acbb6d7467e60cc441618cf1805f4e5eccc4a0caf8b6b6f627e264f92ed3bcdde2899d7035145576c3d2e4b2f95ca5eb2bbaca8d0ea4d90203010001a355305330120603551d130101ff040830060101ff020100301d0603551d0e04160414baf05eca432879dc5a9fe9f563d90721fa1a504b300b0603551d0f040403020106301106096086480186f8420101040403020007300d06092a864886f70d01010b05000382010100c08cf619a76feef45d47324122595199e2825f963d4afdee811f2038e5d5fc369518cdb0fb4d0412499417a7f4f7308955370c7f1aa84a5806884b78817924ef7d5332214c70f0411d4434bdd009b6094fe5e1ec61a380058abfde0eb6f66f0727e74d6109266a36b2d563fdd9999d8eecd752271286e605247ef552ace03bb93550440002423e129308f4aeb1f416f33f8c4969abf2af6bcb33f5833e14aa51cb2194e9978cfe9f4158b2964faf0233841ddb09bac430b32981e65ef39611521e45b0188b549541d1188317fa287b987b9fc312613b63b218eafbe1d7152e175d58b313d67e59a3a691b73c0addf8eb2a2d8778392ff28b25faa6ff9145b080	CrossEX_LocalService_Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79\Blob = 030000000100000014000000dc2f16a0e1af8faf0d3e93eac9aca7315a409c792000000001000000b6030000308203b23082029aa003020102020101300d06092a864886f70d01010b05003070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f744341323020170d3138313031303038323831355a180f32303939313233313038323831355a3070310b3009060355040613024b523113301106035504080c0a536f6d652d5374617465310e300c06035504070c0553656f756c311a3018060355040a0c11696e694c494e4520436f2e2c204c74642e3120301e06035504030c17696e694c494e452043726f7373455820526f6f7443413230820122300d06092a864886f70d01010105000382010f003082010a0282010100c74641aea9b5c3ac70c760c8b9b4d913239c9f1f2ba22ec168ddf87c291a6f7bf65039a350a4df32666610daeef39f518c94566fb0883e95d5954bb6fa77fb741d85321d4779043dfae7530d23f0834bd602eac8380298c246d0ab9d8ad4c1b11fdfe8dac89f57872151fb07494e2611db05fd7a911b2072731304b583a100a8346d3e75aee2bc90fc82eda089b475919abc33f9c44b4d1642d059e6818d723c6a725bdbf3f1b0936580a6fe2cf8009d382e5e6bc1e8f16869c153d0cd1f58359761f250b8f2f28227acbb6d7467e60cc441618cf1805f4e5eccc4a0caf8b6b6f627e264f92ed3bcdde2899d7035145576c3d2e4b2f95ca5eb2bbaca8d0ea4d90203010001a355305330120603551d130101ff040830060101ff020100301d0603551d0e04160414baf05eca432879dc5a9fe9f563d90721fa1a504b300b0603551d0f040403020106301106096086480186f8420101040403020007300d06092a864886f70d01010b05000382010100c08cf619a76feef45d47324122595199e2825f963d4afdee811f2038e5d5fc369518cdb0fb4d0412499417a7f4f7308955370c7f1aa84a5806884b78817924ef7d5332214c70f0411d4434bdd009b6094fe5e1ec61a380058abfde0eb6f66f0727e74d6109266a36b2d563fdd9999d8eecd752271286e605247ef552ace03bb93550440002423e129308f4aeb1f416f33f8c4969abf2af6bcb33f5833e14aa51cb2194e9978cfe9f4158b2964faf0233841ddb09bac430b32981e65ef39611521e45b0188b549541d1188317fa287b987b9fc312613b63b218eafbe1d7152e175d58b313d67e59a3a691b73c0addf8eb2a2d8778392ff28b25faa6ff9145b080	CrossEX_LocalService_Install.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4\Blob = 030000000100000014000000ddfb16cd4931c973a2037d3fc83a4d7d775d05e42000000001000000940500003082059030820378a0030201020210059b1b579e8e2132e23907bda777755c300d06092a864886f70d01010c05003062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f74204734301e170d3133303830313132303030305a170d3338303131353132303030305a3062310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3121301f060355040313184469676943657274205472757374656420526f6f7420473430820222300d06092a864886f70d01010105000382020f003082020a0282020100bfe6907368debbe45d4a3c3022306933ecc2a7252ec9213df28ad859c2e129a73d58ab769acdae7b1b840dc4301ff31ba43816eb56c6976d1dabb279f2ca11d2e45fd6053c520f521fc69e15a57ebe9fa95716595572af689370c2b2ba75996a733294d11044102edf82f30784e6743b6d71e22d0c1bee20d5c9201d63292dceec5e4ec893f821619b34eb05c65eec5b1abcebc9cfcdac34405fb17a66ee77c848a86657579f54588e0c2bb74fa730d956eeca7b5de3adc94f5ee535e731cbda935edc8e8f80dab69198409079c378c7b6b1c4b56a183803108dd8d437a42e057d88f5823e109170ab55824132d7db04732a6e91017c214cd4bcae1b03755d7866d93a31449a3340bf08d75a49a4c2e6a9a067dda427bca14f39b5115817f7245c468f64f7c169887698763d595d4276878997697a48f0e0a2121b669a74cade4b1ee70e63aee6d4ef92923a9e3ddc00e4452589b69a44192b7ec094b4d2616deb33d9c5df4b0400cc7d1c95c38ff721b2b211b7bb7ff2d58c702c4160aab1631844951a76627ef680b0fbe864a633d18907e1bdb7e643a418b8a67701e10f940c211db2542925896ce50e52514774be26acb64175de7aac5f8d3fc9bcd34111125be51050eb31c5ca72162209df7c4c753f63ec215fc420516b6fb1ab868b4fc2d6455f9d20fca11ec5c08fa2b17e0a2699f5e4692f981d2df5d9a9b21de51b0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020186301d0603551d0e04160414ecd7e382d2715d644cdf2e673fe7ba98ae1c0f4f300d06092a864886f70d01010c05000382020100bb61d97da96cbe17c4911bc3a1a2008de364680f56cf77ae70f9fd9a4a99b9c9785c0c0c5fe4e61429560b36495d4463e0ad9c9618661b230d3d79e96d6bd654f8d23cc14340ae1d50f552fc903bbb9899696bc7c1a7a868a427dc9df927ae3085b9f6674d3a3e8f5939225344ebc85d03caed507a7d62210a80c87366d1a005605fe8a5b4a7afa8f76d359c7c5a8ad6a23899f3788bf44dd2200bde04ee8c9b4781720dc01432ef30592eaee071f256e46a976f92506d968d687a9ab236147a06f224b9091150d708b1b8897a8423614229e5a3cda22041d7d19c64d9ea26a18b14d74c19b25041713d3f4d7023860c4adc81d2cc3294840d0809971c4fc0ee6b207430d2e03934108521150108e85532de7149d92817504de6be4dd175acd0cafb41b843a5aad3c305444f2c369be2fae245b823536c066f67557f46b54c3f6e285a7926d2a4a86297d21ee2ed4a8bbc1bfd474a0ddf67667eb25b41d03be4f43bf40463e9efc2540051a08a2ac9ce78ccd5ea870418b3ceaf4988aff39299b6b3e6610fd28500e7501ae41b959d19a1b99cb19bb1001eefd00f4f426cc90abcee43fa3a71a5c84d26a535fd895dbc85621d32d2a02b54ed9a57c1dbfa10cf19b78b4a1b8f01b6279553e8b6896d5bbc68d423e88b51a256f9f0a680a0d61eb3bc0f0f537529aaea1377e4de8c8121ad07104711ad873d07d175bccff3667e	raon_touchenex_Install.exe

System Location Discovery: System Language Discovery 1 TTPs 46 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raon_touchenex_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox_CertUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEXService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox_CertUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEXService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raon_touchenex_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEXService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEX_LocalService_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFCert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFCert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFCert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEXService.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFCert.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raon_touchenex_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEX_LocalService_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEX_LocalService_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFWP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	raon_touchenex_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DllHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox_CertUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CrossEX_LocalService_Install.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TEFW_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Firefox_CertUtil.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	certutil.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4060	chrome.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x000800000001da63-505.dat	nsis_installer_1
behavioral1/files/0x000800000001da63-505.dat	nsis_installer_2
behavioral1/files/0x000800000001da68-595.dat	nsis_installer_1
behavioral1/files/0x000800000001da68-595.dat	nsis_installer_2

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	chrome.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

defense_evasion spyware trojan

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies data under HKEY_USERS 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	CrossEX_LocalService_Install.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CrossEXService = "C:\\Program Files (x86)\\iniLINE\\CrossEX\\crossex\\CrossEXService.exe"	CrossEX_LocalService_Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	CrossEX_LocalService_Install.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CrossEXService = "C:\\Program Files (x86)\\iniLINE\\CrossEX\\crossex\\CrossEXService.exe"	CrossEX_LocalService_Install.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316156127944838"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	CrossEX_LocalService_Install.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CrossEXService = "C:\\Program Files (x86)\\iniLINE\\CrossEX\\crossex\\CrossEXService.exe"	CrossEX_LocalService_Install.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run	CrossEX_LocalService_Install.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run\CrossEXService = "C:\\Program Files (x86)\\iniLINE\\CrossEX\\crossex\\CrossEXService.exe"	CrossEX_LocalService_Install.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12123#immutable1 = "Set firewall security options to help protect your computer from hackers and malicious software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sdcpl.dll,-100#immutable1 = "Recover copies of your files backed up in Windows 7"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\accessibilitycpl.dll,-10#immutable1 = "Ease of Access Center"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\MRUListEx = ffffffff	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\srchadmin.dll,-601#immutable1 = "Indexing Options"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\systemcpl.dll,-2#immutable1 = "View information about your computer, and change settings for hardware, performance, and remote connections."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-52#immutable1 = "Set the date, time, and time zone for your computer."	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByKey:PID = "0"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\NodeSlot = "4"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\touchenexProtocol.ProtocolMain.1\CLSID\ = "{4016c30a-fd7b-11ef-941e-000c2936bd4f}"	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}\ProxyStubClsid32	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}\TypeLib	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-159#immutable1 = "Programs and Features"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-1#immutable1 = "Network and Sharing Center"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\IconSize = "48"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4016c30a-fd7b-11ef-941e-000c2936bd4f}\InprocServer32\ThreadingModel = "Apartment"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9544A71-CBFA-4CE0-A01B-28F39B976CC9}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\RaonSecure\\bridge\\CrossEX\\touchenex\\1.0.1.1604"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\DeviceCenter.dll,-2000#immutable1 = "View and manage devices, printers, and print jobs"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\Children	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\sud.dll,-1#immutable1 = "Default Programs"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\DiagCpl.dll,-1#immutable1 = "Troubleshooting"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9544A71-CBFA-4CE0-A01B-28F39B976CC9}\1.0\FLAGS\ = "0"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428\DisplayName = "Chrome Sandbox"	chrome.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\autoplay.dll,-2#immutable1 = "Change default settings for CDs, DVDs, and devices so that you can automatically play music, view pictures, install software, and play games."	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\touchenexProtocol.ProtocolMain\CLSID\ = "{4016c30a-fd7b-11ef-941e-000c2936bd4f}"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\Vault.dll,-2#immutable1 = "Manage your Windows credentials."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\devmgr.dll,-5#immutable1 = "View and update your device hardware settings and driver software."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\timedate.cpl,-51#immutable1 = "Date and Time"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\LogicalViewMode = "2"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9544A71-CBFA-4CE0-A01B-28F39B976CC9}\1.0\ = "CrossExProtocol 1.0 Çü½Ä ¶óÀÌºê·¯¸®"	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}\ProxyStubClsid32	raon_touchenex_Install.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-620072444-2846605723-1118207114-1642104096-81213792-2370344205-2712285428	chrome.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874385"	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\FFlags = "18874369"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4016c30a-fd7b-11ef-941e-000c2936bd4f}\VersionIndependentProgID	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\touchenex	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\intl.cpl,-3#immutable1 = "Region"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\netcenter.dll,-2#immutable1 = "Check network status, change network settings and set preferences for sharing files and printers."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\recovery.dll,-101#immutable1 = "Recovery"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C3ED391-18E2-461F-9CFF-7F3C679AB560}\TypeLib\ = "{E9544A71-CBFA-4CE0-A01B-28F39B976CC9}"	raon_touchenex_Install.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\main.cpl,-101#immutable1 = "Customize your mouse settings, such as the button configuration, double-click speed, mouse pointers, and motion speed."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\system32\appwiz.cpl,-160#immutable1 = "Uninstall or change programs on your computer."	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\fhcpl.dll,-52#immutable1 = "File History"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupByDirection = "1"	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4016c30a-fd7b-11ef-941e-000c2936bd4f}\InprocServer32	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4016c30a-fd7b-11ef-941e-000c2936bd4f}\TypeLib	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4016c30a-fd7b-11ef-941e-000c2936bd4f}	raon_touchenex_Install.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\ImmutableMuiCache\Strings\52C64B7E\@C:\Windows\System32\FirewallControlPanel.dll,-12122#immutable1 = "Windows Defender Firewall"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{DE4F0660-FA10-4B8F-A494-068B20B22307}\GroupView = "0"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\touchenex\	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E9544A71-CBFA-4CE0-A01B-28F39B976CC9}\1.0\FLAGS	raon_touchenex_Install.exe

Modifies system certificate store 2 TTPs 5 IoCs

Install Root Certificate

T1553.004

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79	CrossEX_LocalService_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79	CrossEX_LocalService_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79	CrossEX_LocalService_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DDFB16CD4931C973A2037D3FC83A4D7D775D05E4	raon_touchenex_Install.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\DC2F16A0E1AF8FAF0D3E93EAC9ACA7315A409C79	CrossEX_LocalService_Install.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1212	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
4848	chrome.exe
4848	chrome.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
1204	Firefox_CertUtil.exe
1204	Firefox_CertUtil.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
2920	ObCrossEXService.exe
4532	TEFSvrP64.exe
4532	TEFSvrP64.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1464	taskmgr.exe
1212	explorer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe
Token: SeShutdownPrivilege	3976	chrome.exe
Token: SeCreatePagefilePrivilege	3976	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
3976	chrome.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe
1464	taskmgr.exe

Suspicious use of SetWindowsHookEx 46 IoCs

pid	Process
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
1188	TEFW_Installer.exe
3824	TEFWP.exe
3824	TEFWP.exe
4848	TEFWP64.exe
4848	TEFWP64.exe
2260	raon_touchenex_Install.exe
4264	CrossEX_LocalService_Install.exe
2428	CrossEXService.exe
4464	FFCert.exe
1204	Firefox_CertUtil.exe
1204	Firefox_CertUtil.exe
3500	TEFW_Installer.exe
3500	TEFW_Installer.exe
3500	TEFW_Installer.exe
3500	TEFW_Installer.exe
3140	TEFWP.exe
3140	TEFWP.exe
1260	raon_touchenex_Install.exe
2300	TEFWP64.exe
2300	TEFWP64.exe
4904	CrossEX_LocalService_Install.exe
4468	CrossEXService.exe
2664	FFCert.exe
1864	Firefox_CertUtil.exe
1864	Firefox_CertUtil.exe
4004	TEFW_Installer.exe
4004	TEFW_Installer.exe
4004	TEFW_Installer.exe
5032	TEFWP.exe
5032	TEFWP.exe
3424	TEFWP64.exe
3424	TEFWP64.exe
1144	Firefox_CertUtil.exe
4548	TEFW_Installer.exe
4548	TEFW_Installer.exe
4548	TEFW_Installer.exe
4944	TEFWP.exe
4944	TEFWP.exe
2300	TEFWP64.exe
2300	TEFWP64.exe
2604	Firefox_CertUtil.exe
1456	TEFSvrP64.exe
4416	TouchEn_nxFW_Installer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 3788	3976	chrome.exe	86
PID 3976 wrote to memory of 4060	3976	chrome.exe	87
PID 3976 wrote to memory of 1336	3976	chrome.exe	88
PID 3976 wrote to memory of 1336	3976	chrome.exe	88
PID 3976 wrote to memory of 4736	3976	chrome.exe	89
PID 3976 wrote to memory of 4736	3976	chrome.exe	89
PID 3976 wrote to memory of 4188	3976	chrome.exe	92
PID 3976 wrote to memory of 4188	3976	chrome.exe	92
PID 3976 wrote to memory of 2284	3976	chrome.exe	91
PID 3976 wrote to memory of 2284	3976	chrome.exe	91
PID 3976 wrote to memory of 3480	3976	chrome.exe	93
PID 3976 wrote to memory of 3480	3976	chrome.exe	93
PID 3976 wrote to memory of 1860	3976	chrome.exe	95
PID 3976 wrote to memory of 3656	3976	chrome.exe	100
PID 3976 wrote to memory of 1512	3976	chrome.exe	101
PID 3976 wrote to memory of 2880	3976	chrome.exe	102
PID 3976 wrote to memory of 4848	3976	chrome.exe	112
PID 3976 wrote to memory of 2608	3976	chrome.exe	114
PID 3976 wrote to memory of 1188	3976	chrome.exe	115
PID 4532 wrote to memory of 3824	4532	TEFSvrP64.exe	118
PID 3824 wrote to memory of 4848	3824	TEFWP.exe	119
PID 1188 wrote to memory of 2260	1188	TEFW_Installer.exe	120
PID 1188 wrote to memory of 4264	1188	TEFW_Installer.exe	121
PID 4264 wrote to memory of 2428	4264	CrossEX_LocalService_Install.exe	122
PID 4264 wrote to memory of 1212	4264	CrossEX_LocalService_Install.exe	123
PID 4264 wrote to memory of 4936	4264	CrossEX_LocalService_Install.exe	125
PID 4264 wrote to memory of 3340	4264	CrossEX_LocalService_Install.exe	127
PID 1188 wrote to memory of 4464	1188	TEFW_Installer.exe	130
PID 4464 wrote to memory of 1204	4464	FFCert.exe	131
PID 1204 wrote to memory of 4788	1204	Firefox_CertUtil.exe	132
PID 1204 wrote to memory of 2296	1204	Firefox_CertUtil.exe	134
PID 3976 wrote to memory of 3840	3976	chrome.exe	136
PID 3976 wrote to memory of 3840	3976	chrome.exe	136
PID 3976 wrote to memory of 3500	3976	chrome.exe	142
PID 4644 wrote to memory of 3140	4644	TEFSvrP64.exe	146
PID 3500 wrote to memory of 1260	3500	TEFW_Installer.exe	147
PID 3140 wrote to memory of 2300	3140	TEFWP.exe	148
PID 3500 wrote to memory of 4904	3500	TEFW_Installer.exe	149
PID 4904 wrote to memory of 4468	4904	CrossEX_LocalService_Install.exe	150
PID 4904 wrote to memory of 2244	4904	CrossEX_LocalService_Install.exe	151
PID 4904 wrote to memory of 3644	4904	CrossEX_LocalService_Install.exe	153
PID 4904 wrote to memory of 1640	4904	CrossEX_LocalService_Install.exe	155
PID 3500 wrote to memory of 2664	3500	TEFW_Installer.exe	158
PID 2664 wrote to memory of 1864	2664	FFCert.exe	159
PID 1864 wrote to memory of 708	1864	Firefox_CertUtil.exe	160
PID 1864 wrote to memory of 2604	1864	Firefox_CertUtil.exe	162
PID 3976 wrote to memory of 4004	3976	chrome.exe	164
PID 1852 wrote to memory of 5032	1852	TEFSvrP64.exe	168
PID 5032 wrote to memory of 3424	5032	TEFWP.exe	170
PID 4004 wrote to memory of 1232	4004	TEFW_Installer.exe	169
PID 4004 wrote to memory of 3480	4004	TEFW_Installer.exe	171
PID 3480 wrote to memory of 3952	3480	CrossEX_LocalService_Install.exe	172
PID 3480 wrote to memory of 3228	3480	CrossEX_LocalService_Install.exe	173
PID 3480 wrote to memory of 2548	3480	CrossEX_LocalService_Install.exe	175
PID 3480 wrote to memory of 3000	3480	CrossEX_LocalService_Install.exe	177
PID 4004 wrote to memory of 1388	4004	TEFW_Installer.exe	180
PID 1388 wrote to memory of 1144	1388	FFCert.exe	181
PID 1144 wrote to memory of 1964	1144	Firefox_CertUtil.exe	182
PID 1144 wrote to memory of 2244	1144	Firefox_CertUtil.exe	184
PID 3376 wrote to memory of 4944	3376	TEFSvrP64.exe	194
PID 4944 wrote to memory of 2300	4944	TEFWP.exe	196
PID 4548 wrote to memory of 4152	4548	TEFW_Installer.exe	195
PID 4548 wrote to memory of 4408	4548	TEFW_Installer.exe	197
PID 4408 wrote to memory of 3368	4408	CrossEX_LocalService_Install.exe	198

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.sgic.co.kr/biz/ccp/index.html?p=CCPCST050301F01&url=https%3A%2F%2Fwww.sgic.co.kr%2Fbiz%2Fccp%2Findex.html%3Fp%3DCCPUTL010015F01
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff05bfc728,0x7fff05bfc734,0x7fff05bfc740
  2⤵
  PID:3788
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,5491079527277018088,14741231294299109559,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4060
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1668,i,17439210527916271910,6000629920822653236,262144 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1336
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2396,i,10734825771687266591,4796488366027693527,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1884 /prefetch:8
  2⤵
  PID:4736
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3172,i,12439681430274546374,5896489955331703507,2097152 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3184,i,8491704765238265005,1638496046466270102,2097152 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4388,i,5694036995215179538,4709314288441060633,2097152 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4452 /prefetch:2
  2⤵
  PID:3480
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,3618936461199706417,11330231561197676134,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4712,i,15055622823171017746,14665003884109399898,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5020,i,18083347582739866328,16483961501813704859,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5012,i,1438225514507515392,14487384695305022704,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4708,i,8670862943199585965,9986800042131134167,262144 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4848
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3044,i,8844711792479386285,15115033641322056556,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1488 /prefetch:8
  2⤵
  PID:2608
- C:\Users\Admin\Downloads\TEFW_Installer.exe
  "C:\Users\Admin\Downloads\TEFW_Installer.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1188
- - C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    PID:2260
- - C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
      "C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2428
  - - C:\Windows\SysWOW64\sc.exe
      sc create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1212
  - - C:\Windows\SysWOW64\sc.exe
      sc description "CrossEX Live Checker" "checking live status of CrossEXService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4936
  - - C:\Windows\SysWOW64\sc.exe
      sc start "CrossEX Live Checker"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3340
- - C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe
    "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
      C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -A -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,C"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:4788
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -L -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2296
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --metrics-shmem-handle=4768,i,3646764808554129095,5468365996534429546,524288 --field-trial-handle=2060,i,3300543398576716774,6696956069655001338,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:3840
- C:\Users\Admin\Downloads\TEFW_Installer.exe
  "C:\Users\Admin\Downloads\TEFW_Installer.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3500
- - C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1260
- - C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4904
  - - C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
      "C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4468
  - - C:\Windows\SysWOW64\sc.exe
      sc create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2244
  - - C:\Windows\SysWOW64\sc.exe
      sc description "CrossEX Live Checker" "checking live status of CrossEXService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3644
  - - C:\Windows\SysWOW64\sc.exe
      sc start "CrossEX Live Checker"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1640
- - C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe
    "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
      C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1864
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -A -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,C"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:708
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -L -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        
        PID:2604
- C:\Users\Admin\Downloads\TEFW_Installer.exe
  "C:\Users\Admin\Downloads\TEFW_Installer.exe"
  2⤵
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4004
- - C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1232
- - C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe
    "C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe" /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Drops file in Program Files directory
    - Modifies trusted root certificate store through registry
    - System Location Discovery: System Language Discovery
    - Modifies data under HKEY_USERS
    - Modifies system certificate store
    - Suspicious use of WriteProcessMemory
    PID:3480
  - - C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
      "C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Windows\SysWOW64\sc.exe
      sc create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3228
  - - C:\Windows\SysWOW64\sc.exe
      sc description "CrossEX Live Checker" "checking live status of CrossEXService"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2548
  - - C:\Windows\SysWOW64\sc.exe
      sc start "CrossEX Live Checker"
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3000
- - C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe
    "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1388
  - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
      C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -A -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,C"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
        
        "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -L -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release"
        5⤵
        Executes dropped EXE
        
        PID:2244

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:2112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:4276

C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe
"C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe
  "C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3824
- - C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe
    "C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4848

C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2920

C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe
"C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe
  "C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3140
- - C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe
    "C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300

C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
1⤵
- Executes dropped EXE
PID:1904

C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe
"C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe
  "C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe
    "C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3424

C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
1⤵
- Executes dropped EXE
PID:2924

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1464

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3136

C:\Users\Admin\Downloads\TEFW_Installer.exe
"C:\Users\Admin\Downloads\TEFW_Installer.exe"
1⤵
- Drops file in Drivers directory
- Checks computer location settings
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4548
- C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe
  "C:\Program Files (x86)\TouchEn\Firewall\raon_touchenex_Install.exe" /S
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4152
- C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe
  "C:\Program Files (x86)\TouchEn\Firewall\CrossEX_LocalService_Install.exe" /S
  2⤵
  - Executes dropped EXE
  - Modifies trusted root certificate store through registry
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:4408
- - C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe
    "C:\Program Files (x86)\iniLINE\CrossEX\crossex\CrossEXService.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3368
- - C:\Windows\SysWOW64\sc.exe
    sc create "CrossEX Live Checker" binpath= "\"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe\"" start= auto
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3172
- - C:\Windows\SysWOW64\sc.exe
    sc description "CrossEX Live Checker" "checking live status of CrossEXService"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:952
- - C:\Windows\SysWOW64\sc.exe
    sc start "CrossEX Live Checker"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3348
- C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe
  "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe
    C:\Users\Admin\AppData\Local\Temp\ffcert_raon\Firefox_CertUtil.exe "C:\Program Files (x86)\TouchEn\Firewall\FFCert.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2604
  - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
      "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -A -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release" -i "C:\Program Files (X86)\iniLINE\CrossEX\crossex\rootCA.crt" -n "iniLINE CrossEX RootCA2" -t "CT,C,C"
      4⤵
      Executes dropped EXE
      PID:4276
  - - C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe
      "C:\Users\Admin\AppData\Local\Temp\ffcert_raon\bin\certutil.exe" -L -d sql:"C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ho495kqa.default-release"
      4⤵
      Executes dropped EXE
      PID:4720

C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe
"C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe
  "C:\Program Files (x86)\TouchEn\Firewall\TEFWP.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe
    "C:\Program Files (x86)\TouchEn\Firewall\TEFWP64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2300

C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe
"C:\Program Files (x86)\iniLINE\CrossEX\crossex\ObCrossEXService.exe"
1⤵
- Executes dropped EXE
PID:3804

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
PID:1212

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
- System Location Discovery: System Language Discovery
PID:1232

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{FCC74B77-EC3E-4DD8-A80B-008A702075A9}
1⤵
- System Location Discovery: System Language Discovery
PID:3040
- C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe
  "C:\Program Files (x86)\TouchEn\Firewall\TEFSvrP64.exe" uninstall
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1456
- - C:\Users\Admin\AppData\Local\Temp\TouchEn\TouchEn_nxFW_Installer.exe
    "C:\Users\Admin\AppData\Local\Temp\TouchEn\TouchEn_nxFW_Installer.exe" -UNINSTALLTRUE
    3⤵
    - Drops file in Drivers directory
    - Executes dropped EXE
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery