Analysis
- user interaction
yes - max time kernel
3s - max time network
17s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/10/2026, 13:59
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
fhg.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
fhg.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Errors
Reason
Machine shutdown
General
- Target fhg.exe
- Size 11KB
- Sample261002-raptea11es
- SHA256 64145c83c359bbc68e151d910cddddf37349963ee1ae4319e5e091fdf9a1e1e2
- MD5 1a8613552bfc6bb460c5f57936a5ef22
- SHA1 784328b21483b27008dab1e41c139b0d8566ae49
- SHA512 e3fee0088906aa7ba7a3ae15b55a8845edbb220aa88e749c4f276317ff0d0022bde88bab63003ac0be1d63960e41253eb04ba159eca28d47ddbf20fad580d49c
- SSDEEP 192:BUdqFTGoWELrakCkmx557X0n0E49w6R3ij3Dfe:aroWEivRx7X+0j930n
- TLSH T1DB32F95D73E88A24D5BE4B3628B7D21087B0F0138E27CB5E1CE9A8FD2D277106566B91
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89B4C1CD-B018-4511-B0A1-5476DBF70820} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8A69D345-D564-463c-AFF1-A69D9E530F96} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{9459C573-B17A-45AE-9F64-1857B5D58CEE} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{2C7339CF-2B09-4501-B3F3-F3508C9228ED} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6BF52A52-394A-11d3-B153-00C04F79FAA6} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4340} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383} reg.exe - Manipulates Digital Signatures 1 TTPs 60 IoCs
Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to make their binary seem validly signed.
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CRLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher\CTLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\TrustedPublisher reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPublisher\CTLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs reg.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation fhg.exe - Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
- Accesses Microsoft Outlook profiles 1 TTPs 7 IoCs
description ioc Process Key enumerated \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key opened \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key enumerated \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key opened \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe Key queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe - Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 fhg.exe - Drops file in System32 directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\csrss.exe fhg.exe File opened for modification C:\Windows\System32\spoolsv.exe fhg.exe File opened for modification C:\Windows\System32\ntdll.dll fhg.exe File opened for modification C:\Windows\System32\kernel32.dll fhg.exe File opened for modification C:\Windows\System32\advapi32.dll fhg.exe File opened for modification C:\Windows\System32\wininit.exe fhg.exe File opened for modification C:\Windows\System32\lsass.exe fhg.exe File opened for modification C:\Windows\System32\svchost.exe fhg.exe File opened for modification C:\Windows\System32\gdi32.dll fhg.exe File opened for modification C:\Windows\System32\shell32.dll fhg.exe File opened for modification C:\Windows\System32\ole32.dll fhg.exe File opened for modification C:\Windows\System32\ntoskrnl.exe fhg.exe File opened for modification C:\Windows\System32\smss.exe fhg.exe File opened for modification C:\Windows\System32\dwm.exe fhg.exe File opened for modification C:\Windows\System32\dllhost.exe fhg.exe File opened for modification C:\Windows\System32\user32.dll fhg.exe File opened for modification C:\Windows\System32\winlogon.exe fhg.exe File opened for modification C:\Windows\System32\services.exe fhg.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 5 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4388 cmd.exe 5108 cmd.exe 2520 cmd.exe 2140 cmd.exe 1220 cmd.exe - Checks processor information in registry 2 TTPs 28 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 reg.exe - Enumerates system info in registry 2 TTPs 64 IoCs
description ioc Process Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter reg.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0\DiskPeripheral\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses\PCIBus\0000 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 reg.exe Key deleted \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoAdapterBusses reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\DiskController\0 reg.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral reg.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\24 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\29 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\7 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Help_Menu_URLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\11 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\23 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\PageSetup reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Setup reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\TypedURLs reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop\General reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\28 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\37 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\New Windows reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Security reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\GPU reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\20 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\33 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d99f01ab_0 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Suggested Sites reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation\LowMic reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\BrowserEmulation reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\21 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\34 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Zoom reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\16 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\35 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Settings reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\13 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\25 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\27 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\31 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-word reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\10 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\6 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\d99f01ab_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Desktop reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\15 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts\4 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International\Scripts reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\International reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\DOMStorage reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\ms-powerpoint reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Document Windows reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\IETld\LowMic reg.exe - Modifies data under HKEY_USERS 64 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\AppData\82864fa0-ed49-4711-8395-a0e6003dca1f reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.BackgroundAccess reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\Notification.Looping.Alarm9 reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe%5Cresources.pri\1d5ace4595840bd\a37dfe62 reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri\1d5acddd82645c0\a37dfe62 reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\CriticalBatteryAlarm reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer\EmptyRecycleBin reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\Explorer reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\TabletPC reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call6\.Default reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\CTF\HiddenDummyLayouts reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.Calling reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\Notification.Looping.Call6 reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\ProximityConnection reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\RestoreDown\.Current reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Classes\Local Settings\Software reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Fax\fxsclnt reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Screensavers\Ribbons reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri\1d7e53689ea9e9c reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Call4\.Default reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\sapisvr\DisNumbersSound reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\Disallowed reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.all reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\IdentityCRL\DeviceIdentities\production\S-1-5-21-524788801-3318743092-4051225893-1000\02iihbocceaqxigh reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\CriticalBatteryAlarm reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Assistance\Client reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\Explorer\Navigating\.Default reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\sapisvr\HubOffSound\.default reg.exe Key deleted \REGISTRY\USER\S-1-5-20\Console\%SystemRoot%_SysWOW64_WindowsPowerShell_v1.0_powershell.exe reg.exe Key deleted \REGISTRY\USER\S-1-5-20\Control Panel\PowerCfg\PowerPolicies\3 reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31} reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri\1d5acddee1afafc\a37dfe62 reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0 reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Avalon.Graphics reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\SecurityBand reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\Schemes\Apps\.Default\WindowsLogon\.Default reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\ContentDeliveryManager\Subscriptions reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri\1d7e53665b78b3b\a37dfe62 reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\Common\ClientTelemetry reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Telephony reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\ChangeTheme reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Default\.Current reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm\.Current reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\Schemes\Apps\.Default\Notification.Looping.Alarm9\.Current reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CProgram Files%5CWindowsApps%5CMicrosoft.XboxSpeechToTextOverlay_1.17.29001.0_x64__8wekyb3d8bbwe%5Cresources.pri reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri\1d5acddeb9b0f78\a37dfe62 reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.LocationManager reg.exe Key deleted \REGISTRY\USER\S-1-5-19\Control Panel\Accessibility\HighContrast reg.exe Key deleted \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\CTF\SortOrder\AssemblyItem\0x00000409\{34745C63-B2F0-4784-8B67-5E12C8701A31}\00000000 reg.exe Key deleted \REGISTRY\USER\S-1-5-20\AppEvents\EventLabels\Open reg.exe Key deleted \REGISTRY\USER\S-1-5-20\Control Panel\Quick Actions reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\SystemCertificates\trust reg.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\PushNotifications\Backup\Windows.SystemToast.NfpAppLaunch reg.exe Key deleted \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\RADAR reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubOnSound reg.exe Key deleted \REGISTRY\USER\S-1-5-19\AppEvents\EventLabels\HubSleepSound reg.exe - Modifies registry class 64 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.dsw reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0012-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mp2 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0013-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0027-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0034-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0037-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0041-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0092-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0062-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0132-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0057-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Application.Manifest\DefaultIcon reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\AppX7rm9drdg8sk7vqndwj3sdjw11x96jc0y\Shell reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.html\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.mp2v\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AADJ reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{5AAABB05-F91B-4bce-AB18-D8319DEDABA8} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.mp4\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.ts\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\AppX4ra53nzs9xcdyxf1wgcp31xefscv1jnk\Shell\open reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.jpe\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0037-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0087-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0040-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.hol reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0017-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.bcp\PersistentHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0000-0005-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0057-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0071-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0105-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.srf\PersistentHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0030-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.glb\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ActivatableClasses\Package\Microsoft.Windows.Search_1.14.2.19041_neutral_neutral_cw5n1h2txyewy reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0064-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ppsx\ShellEx\{BB2E617C-0920-11d1-9A0B-00C04FC2D6C1} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.sdp reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.srw\ShellEx\{e357fccd-a995-4576-b01f-234630154e96} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0180-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.adt reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\.fluid\shell reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0020-ABCDEFFEDCBB}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0033-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0054-ABCDEFFEDCBB} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0091-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0137-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0072-ABCDEFFEDCBC}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.dbg\PersistentHandler reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0078-ABCDEFFEDCBA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.ods\ShellEx reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.tlb\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.wmv\PersistentHandler reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\7-Zip.7z reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0014-0002-0013-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0015-0000-0018-ABCDEFFEDCBC} reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0017-0000-0043-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\.api\OpenWithProgids reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ActivatableClasses\Package\Microsoft.MicrosoftEdge_44.19041.1266.0_neutral__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\ActivatableClasses\Package\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0013-0001-0071-ABCDEFFEDCBA}\InprocServer32 reg.exe Key deleted \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\CLSID\{CAFEEFAC-0016-0000-0070-ABCDEFFEDCBB} reg.exe - Modifies registry key 1 TTPs 2 IoCs
pid Process 4860 reg.exe 1864 reg.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3088 fhg.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3088 wrote to memory of 2520 3088 fhg.exe 87 PID 3088 wrote to memory of 2140 3088 fhg.exe 90 PID 3088 wrote to memory of 1220 3088 fhg.exe 92 PID 3088 wrote to memory of 4388 3088 fhg.exe 94 PID 3088 wrote to memory of 5108 3088 fhg.exe 96 PID 1220 wrote to memory of 4860 1220 cmd.exe 98 PID 2520 wrote to memory of 4364 2520 cmd.exe 99 PID 4388 wrote to memory of 4684 4388 cmd.exe 100 PID 2140 wrote to memory of 1864 2140 cmd.exe 101 PID 5108 wrote to memory of 2152 5108 cmd.exe 102 - outlook_office_path 1 IoCs
description ioc Process Key queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Office\16.0\Outlook\Profiles\Outlook reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fhg.exe"C:\Users\Admin\AppData\Local\Temp\fhg.exe"1⤵
- Checks computer location settings
- Writes to the Master Boot Record (MBR)
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3088 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCR /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\system32\reg.exereg delete HKCR /f3⤵
- Modifies registry class
PID:4364
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCU /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2140 -
C:\Windows\system32\reg.exereg delete HKCU /f3⤵
- Boot or Logon Autostart Execution: Active Setup
- Manipulates Digital Signatures
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Modifies Internet Explorer settings
- Modifies registry class
- Modifies registry key
- outlook_office_path
PID:1864
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKLM /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Windows\system32\reg.exereg delete HKLM /f3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Modifies registry key
PID:4860
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKU /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4388 -
C:\Windows\system32\reg.exereg delete HKU /f3⤵
- Manipulates Digital Signatures
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Modifies data under HKEY_USERS
- Modifies registry class
PID:4684
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c reg delete HKCC /f2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\reg.exereg delete HKCC /f3⤵PID:2152
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x2e4 0x2f41⤵PID:1844
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
1Component Object Model Hijacking
1