chaos | 21373a6d949a357dd7cab0df39490d440415d0887316430771923547f65a349c

pid	Process
3824	bcdedit.exe
2096	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command-Line Interface

T1059

File Deletion

T1107

Inhibit System Recovery

pid	Process
3388	wbadmin.exe

Modifies Windows Firewall 1 TTPs 1 IoCs

evasion

Modify Existing Service

T1031

pid	Process
2696	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	VIRUSSS.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 5 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\330867499299d35c5dff831d5c393122.exe	ChatGPTHelper.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\330867499299d35c5dff831d5c393122.exe	ChatGPTHelper.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 4 IoCs

pid	Process
1260	msedge.exe
3740	ChatGPTHelper.exe
228	VIRUSSS.exe
2084	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\Firefox\\Desktop Background.bmp"	firefox.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

T1107

Inhibit System Recovery

pid	Process
2524	vssadmin.exe

Modifies registry class 35 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202020202020202	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202020202020202	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	builder_chaos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Mode = "4"	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6\MRUListEx = ffffffff	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6 = 14002e803accbfb42cdb4c42b0297fe99a87c6410000	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 06000000000000000500000004000000030000000200000001000000ffffffff	builder_chaos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\Shell\SniffedFolderType = "Generic"	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1092616257"	builder_chaos.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByDirection = "1"	builder_chaos.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	builder_chaos.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\10\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	builder_chaos.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	builder_chaos.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\6\NodeSlot = "10"	builder_chaos.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\PCX-master.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 3 IoCs

pid	Process
1136	NOTEPAD.EXE
2124	NOTEPAD.EXE
1864	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2084	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4324	msedge.exe
4324	msedge.exe
2808	msedge.exe
2808	msedge.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe
3740	ChatGPTHelper.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
5048	7zFM.exe
3740	ChatGPTHelper.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeDebugPrivilege	4416	firefox.exe
Token: SeRestorePrivilege	5048	7zFM.exe
Token: 35	5048	7zFM.exe
Token: SeSecurityPrivilege	5048	7zFM.exe
Token: SeDebugPrivilege	4120	builder_chaos.exe
Token: SeDebugPrivilege	1724	vpn.exe
Token: SeDebugPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: SeDebugPrivilege	228	VIRUSSS.exe
Token: SeDebugPrivilege	2084	svchost.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: SeBackupPrivilege	4668	vssvc.exe
Token: SeRestorePrivilege	4668	vssvc.exe
Token: SeAuditPrivilege	4668	vssvc.exe
Token: 33	3740	ChatGPTHelper.exe
Token: SeIncBasePriorityPrivilege	3740	ChatGPTHelper.exe
Token: SeIncreaseQuotaPrivilege	3840	WMIC.exe
Token: SeSecurityPrivilege	3840	WMIC.exe
Token: SeTakeOwnershipPrivilege	3840	WMIC.exe
Token: SeLoadDriverPrivilege	3840	WMIC.exe
Token: SeSystemProfilePrivilege	3840	WMIC.exe
Token: SeSystemtimePrivilege	3840	WMIC.exe
Token: SeProfSingleProcessPrivilege	3840	WMIC.exe
Token: SeIncBasePriorityPrivilege	3840	WMIC.exe
Token: SeCreatePagefilePrivilege	3840	WMIC.exe
Token: SeBackupPrivilege	3840	WMIC.exe
Token: SeRestorePrivilege	3840	WMIC.exe
Token: SeShutdownPrivilege	3840	WMIC.exe
Token: SeDebugPrivilege	3840	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3840	WMIC.exe
Token: SeRemoteShutdownPrivilege	3840	WMIC.exe
Token: SeUndockPrivilege	3840	WMIC.exe
Token: SeManageVolumePrivilege	3840	WMIC.exe
Token: 33	3840	WMIC.exe
Token: 34	3840	WMIC.exe
Token: 35	3840	WMIC.exe
Token: 36	3840	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3840	WMIC.exe
Token: SeSecurityPrivilege	3840	WMIC.exe
Token: SeTakeOwnershipPrivilege	3840	WMIC.exe
Token: SeLoadDriverPrivilege	3840	WMIC.exe
Token: SeSystemProfilePrivilege	3840	WMIC.exe
Token: SeSystemtimePrivilege	3840	WMIC.exe

Suspicious use of FindShellTrayWindow 18 IoCs

pid	Process
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
5048	7zFM.exe
5048	7zFM.exe
4416	firefox.exe
4416	firefox.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
1724	vpn.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe

Suspicious use of SetWindowsHookEx 39 IoCs

pid	Process
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
4416	firefox.exe
260	AegisCrypter.exe
260	AegisCrypter.exe
260	AegisCrypter.exe
260	AegisCrypter.exe
260	AegisCrypter.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4120	builder_chaos.exe
4580	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 1944 wrote to memory of 4416	1944	firefox.exe	89
PID 4416 wrote to memory of 5020	4416	firefox.exe	90
PID 4416 wrote to memory of 5020	4416	firefox.exe	90
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4948	4416	firefox.exe	91
PID 4416 wrote to memory of 4804	4416	firefox.exe	92
PID 4416 wrote to memory of 4804	4416	firefox.exe	92
PID 4416 wrote to memory of 4804	4416	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\Explorer.exe
C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\ChatgptHelper.bin.zip
1⤵
PID:2084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Sets desktop wallpaper using registry
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4416
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.0.421061428\1850257956" -parentBuildID 20221007134813 -prefsHandle 1868 -prefMapHandle 1864 -prefsLen 20812 -prefMapSize 232645 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4db3d812-a796-43a2-888d-48497b2ae3aa} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 1948 1d7a77edc58 gpu
    3⤵
    PID:5020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.1.1789579698\895757309" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20848 -prefMapSize 232645 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {526f5396-d345-4646-9cb3-c26597439843} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 2332 1d79a872e58 socket
    3⤵
    - Checks processor information in registry
    PID:4948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.2.2035556164\96083036" -childID 1 -isForBrowser -prefsHandle 2928 -prefMapHandle 2904 -prefsLen 20931 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c286d624-f8ca-4bfb-8a67-8f70e701453e} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 3084 1d7a776d358 tab
    3⤵
    PID:4804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.3.1525035204\1565588459" -childID 2 -isForBrowser -prefsHandle 3412 -prefMapHandle 3516 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdd95dcb-1972-4e22-acbc-a3c7623a2f6a} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 3424 1d7a9c33b58 tab
    3⤵
    PID:944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.4.1224249267\1564533101" -childID 3 -isForBrowser -prefsHandle 4112 -prefMapHandle 4108 -prefsLen 26441 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b250200e-325e-451d-be30-9790045a9004} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 4124 1d7ac73ca58 tab
    3⤵
    PID:2748
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.5.2062308828\173582402" -childID 4 -isForBrowser -prefsHandle 4740 -prefMapHandle 2860 -prefsLen 26579 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba91adca-eb9a-420d-86ee-4e37b43a4163} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 2836 1d7ad2b3258 tab
    3⤵
    PID:4288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.6.1438319492\2110561469" -childID 5 -isForBrowser -prefsHandle 3764 -prefMapHandle 3760 -prefsLen 26579 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1b283a13-a2a6-4027-b5df-a96aedcbd4b1} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 2896 1d7ab378558 tab
    3⤵
    PID:3208
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.7.564793656\1826445204" -childID 6 -isForBrowser -prefsHandle 5168 -prefMapHandle 5192 -prefsLen 26844 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {305f1968-ca3f-4d7e-b511-557d011a2ccb} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5244 1d7a8fe4b58 tab
    3⤵
    PID:232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.8.1887480739\781761651" -childID 7 -isForBrowser -prefsHandle 5252 -prefMapHandle 5248 -prefsLen 26844 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {989a82ba-0b86-437c-bebd-34349898be9a} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5152 1d7a8fe5458 tab
    3⤵
    PID:3648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.9.1133067292\2015982769" -childID 8 -isForBrowser -prefsHandle 5936 -prefMapHandle 5904 -prefsLen 26861 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {79fe17e2-3aaf-4cc0-a54e-909dd4875d4f} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5764 1d79a871c58 tab
    3⤵
    PID:2656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.10.1797170210\483191793" -childID 9 -isForBrowser -prefsHandle 6580 -prefMapHandle 6468 -prefsLen 27979 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {895f5019-828d-4f3c-81d9-ccba007679b2} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 6440 1d7acf69b58 tab
    3⤵
    PID:1880
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.11.1310693751\801810913" -childID 10 -isForBrowser -prefsHandle 6548 -prefMapHandle 1628 -prefsLen 27979 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c77eafb1-194b-4ce2-a52f-da934bf1d42b} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 1652 1d7ad2b1458 tab
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.12.943773778\215291106" -childID 11 -isForBrowser -prefsHandle 4556 -prefMapHandle 5028 -prefsLen 28137 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd6f59c6-e2ff-4332-aaeb-c0a1598a8a05} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 6396 1d7ada05058 tab
    3⤵
    PID:412
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.13.450574633\2084901521" -childID 12 -isForBrowser -prefsHandle 2892 -prefMapHandle 3768 -prefsLen 28146 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ea59f1e0-1626-47e9-8325-23a5ae556881} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5000 1d7aba4a758 tab
    3⤵
    PID:2240
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.14.565225307\1755318111" -childID 13 -isForBrowser -prefsHandle 5920 -prefMapHandle 5556 -prefsLen 29379 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95711b9c-ae16-4a20-9285-4cd09db35099} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 1372 1d7aa7a0858 tab
    3⤵
    PID:2784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.15.1836824175\2008941276" -childID 14 -isForBrowser -prefsHandle 5592 -prefMapHandle 5900 -prefsLen 29379 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {de852392-d13e-488e-99f6-18456dfad0f4} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5584 1d7aba49558 tab
    3⤵
    PID:2472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.16.117060125\1748923605" -childID 15 -isForBrowser -prefsHandle 5368 -prefMapHandle 5428 -prefsLen 29379 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28f4131a-2dc7-48ae-9ade-fa9508ed2430} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5740 1d7abbb9b58 tab
    3⤵
    PID:2168
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.17.1349698987\1972011643" -childID 16 -isForBrowser -prefsHandle 6844 -prefMapHandle 6420 -prefsLen 29379 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd98a1ae-a501-418d-869e-89ce3f5fbd00} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5344 1d7ac124458 tab
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4416.18.46863011\928565597" -childID 17 -isForBrowser -prefsHandle 4752 -prefMapHandle 4996 -prefsLen 29542 -prefMapSize 232645 -jsInitHandle 1480 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c988092c-a66b-4290-b76f-cc17ee83da24} 4416 "\\.\pipe\gecko-crash-server-pipe.4416" 5860 1d7a7491158 tab
    3⤵
    PID:4836

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4464

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\ChatgptHelper.bin.zip"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5048

C:\Users\Admin\Desktop\vpn.exe
"C:\Users\Admin\Desktop\vpn.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1724

C:\Users\Admin\Desktop\AegisCrypter.exe
"C:\Users\Admin\Desktop\AegisCrypter.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:260

C:\Users\Admin\Desktop\builder_chaos.exe
"C:\Users\Admin\Desktop\builder_chaos.exe"
1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4120
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jf4armeg\jf4armeg.cmdline"
  2⤵
  PID:2712
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB61.tmp" "c:\Users\Admin\Desktop\CSC7AD32FF95CC14F3D8130511B29A6D552.TMP"
    3⤵
    PID:4620
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ggamwsk5\ggamwsk5.cmdline"
  2⤵
  PID:2544
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES67FA.tmp" "c:\Users\Admin\Desktop\CSCF89FFA43B6ED447C88AB7630AE1F48.TMP"
    3⤵
    PID:4280

C:\Users\Admin\Desktop\builder_hakops.exe
"C:\Users\Admin\Desktop\builder_hakops.exe"
1⤵
PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://hakops.com/
  2⤵
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ff929f946f8,0x7ff929f94708,0x7ff929f94718
    3⤵
    PID:3000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2976 /prefetch:8
    3⤵
    PID:716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16053091765187127767,10995845334224842882,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
    3⤵
    - Executes dropped EXE
    PID:1260

C:\Users\Admin\Desktop\lol.exe
"C:\Users\Admin\Desktop\lol.exe"
1⤵
PID:1260
- C:\Users\Admin\AppData\Local\Temp\ChatGPTHelper.exe
  "C:\Users\Admin\AppData\Local\Temp\ChatGPTHelper.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  PID:3740
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ChatGPTHelper.exe" "ChatGPTHelper.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:2696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201811
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    PID:4992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xf8,0x12c,0x7ff929f946f8,0x7ff929f94708,0x7ff929f94718
      4⤵
      PID:4988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
      4⤵
      PID:2196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
      4⤵
      PID:1848
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
      4⤵
      PID:3972
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
      4⤵
      PID:4944
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
      4⤵
      PID:3948
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
      4⤵
      PID:4956
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
      4⤵
      PID:2852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
      4⤵
      PID:4464
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
      4⤵
      PID:5032
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
      4⤵
      PID:1616
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5924 /prefetch:8
      4⤵
      PID:2056
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:276
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
      4⤵
      PID:1080
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2720 /prefetch:8
      4⤵
      PID:4976
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
      4⤵
      PID:5240
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,1847789214471957847,12938643327388989663,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2584 /prefetch:2
      4⤵
      PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Users\Admin\Desktop\VIRUSSS.exe
"C:\Users\Admin\Desktop\VIRUSSS.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:228
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2084
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    PID:2192
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2524
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:3840
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    PID:2060
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:3824
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2096
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    PID:4680
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:3388
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:1136

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\read_it.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:1864

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
PID:956

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:4128

C:\Users\Admin\Desktop\Petya Builder\GoldenEye Builder.exe
"C:\Users\Admin\Desktop\Petya Builder\GoldenEye Builder.exe"
1⤵
PID:3760

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1548
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  PID:1972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.0.485410507\1596654712" -parentBuildID 20221007134813 -prefsHandle 2372 -prefMapHandle 1728 -prefsLen 17985 -prefMapSize 230957 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e174ec1-2cd1-45ac-855b-1a93f691abeb} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 2400 21b52af0758 socket
    3⤵
    PID:3024
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.1.167248574\1555606661" -parentBuildID 20221007134813 -prefsHandle 2456 -prefMapHandle 2452 -prefsLen 18538 -prefMapSize 230957 -appDir "C:\Program Files\Mozilla Firefox\browser" - {88d7c5de-bdf7-4192-8c32-51f068031709} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 2476 21b539d9858 gpu
    3⤵
    PID:5084
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.2.1591082026\1417806617" -childID 1 -isForBrowser -prefsHandle 3268 -prefMapHandle 2808 -prefsLen 19382 -prefMapSize 230957 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {531bb152-cf9f-4d42-8e3c-f3adba4b8e1a} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 3292 21b56a6de58 tab
    3⤵
    PID:5816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.3.930779354\590328573" -childID 2 -isForBrowser -prefsHandle 2956 -prefMapHandle 4124 -prefsLen 19490 -prefMapSize 230957 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4957f37d-075f-4b26-bd7f-3aa9cf84e898} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 3140 21b55718e58 tab
    3⤵
    PID:5220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.4.1508874631\1677787167" -childID 3 -isForBrowser -prefsHandle 3800 -prefMapHandle 4136 -prefsLen 20818 -prefMapSize 230957 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12703fd9-448e-4122-a7e4-a389bb61b4a9} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 3032 21b5714b258 tab
    3⤵
    PID:2116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.5.1938916309\2001684680" -childID 4 -isForBrowser -prefsHandle 1788 -prefMapHandle 1688 -prefsLen 27101 -prefMapSize 230957 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {079f8808-9e3c-4ec3-bcdb-3f6856bad073} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 1572 21b57a06758 tab
    3⤵
    PID:5288
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1972.6.1669086285\986963980" -childID 5 -isForBrowser -prefsHandle 4652 -prefMapHandle 4584 -prefsLen 28237 -prefMapSize 230957 -jsInitHandle 1176 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fb655b16-85dd-4cd1-9016-043175428b76} 1972 "\\.\pipe\gecko-crash-server-pipe.1972" 4628 21b57429c58 tab
    3⤵
    PID:3224

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\read_it.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Users\Admin\Desktop\WinXP.Horror.Destructive (Created By WobbyChip).exe
"C:\Users\Admin\Desktop\WinXP.Horror.Destructive (Created By WobbyChip).exe"
1⤵
PID:5680

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3940

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x438 0x2fc
1⤵
PID:5660

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:800

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa391e055 /state1:0x41c64e6d
1⤵
PID:5348

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery