3759744039346620e9613f40f90e8f318e5f54ad49c070e2bd23b667f7e65bf6

Virtualization/Sandbox Evasion

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	NebulaSetup.exe

Looks for VMWare Tools registry key 2 TTPs 3 IoCs

evasion

Query Registry

Virtualization/Sandbox Evasion

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\VMWare, Inc.\VMWare Tools	NebulaSetup.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	NebulaSetup.exe

Executes dropped EXE 9 IoCs

Processes:

7z2201-x64.exe7z2201-x64.exe7zG.exe7zFM.exeMercurial.exeMercurial.exeNebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

pid	process
4452	7z2201-x64.exe
2468	7z2201-x64.exe
1460	7zG.exe
4312	7zFM.exe
3736	Mercurial.exe
3416	Mercurial.exe
704	NebulaSetup.exe
644	NebulaSetup.exe
216	NebulaSetup.exe

Loads dropped DLL 4 IoCs

Processes:

7zG.exe7zFM.exe

pid process

3108
1460 7zG.exe
4312 7zFM.exe
4312 7zFM.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

pid	process
3108
1460	7zG.exe
4312	7zFM.exe
4312	7zFM.exe

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

7z2201-x64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

559 ip-api.com
203 ip4.seeip.org
204 ip4.seeip.org
205 ip4.seeip.org
206 ip-api.com
556 ip4.seeip.org
557 ip4.seeip.org
558 ip4.seeip.org

flow	ioc
559	ip-api.com
203	ip4.seeip.org
204	ip4.seeip.org
205	ip4.seeip.org
206	ip-api.com
556	ip4.seeip.org
557	ip4.seeip.org
558	ip4.seeip.org

Maps connected drives based on registry 3 TTPs 6 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	NebulaSetup.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2201-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ne.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\is.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mk.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7zFM.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spc.txt	7z2201-x64.exe
File created	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tg.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.exe	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	7z2201-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2201-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
3892	1484	WerFault.exe	Mercurial.exe
5000	1484	WerFault.exe	Mercurial.exe
4704	3736	WerFault.exe	Mercurial.exe
2848	3736	WerFault.exe	Mercurial.exe
3396	3416	WerFault.exe	Mercurial.exe
2060	3416	WerFault.exe	Mercurial.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_VMware_&Prod_VMware_Virtual_S	NebulaSetup.exe

Checks processor information in registry 2 TTPs 25 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exefirefox.exefirefox.exeNebulaSetup.exefirefox.exeNebulaSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NebulaSetup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	NebulaSetup.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

System Information Discovery

Processes:

NebulaSetup.exeNebulaSetup.exeNebulaSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosInformation	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemManufacturer	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemProductName	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	NebulaSetup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Logical Unit Id 0	NebulaSetup.exe

Modifies registry class 23 IoCs

Processes:

7z2201-x64.exefirefox.exefirefox.exefirefox.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\ = "7-Zip Shell Extension"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip.dll"	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ThreadingModel = "Apartment"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{23170F69-40C1-278A-1000-000100020000}\InprocServer32\ = "C:\\Program Files\\7-Zip\\7-zip32.dll"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{23170F69-40C1-278A-1000-000100020000}	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\*\shellex\ContextMenuHandlers\7-Zip	7z2201-x64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Folder\shellex\ContextMenuHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2201-x64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Drive\shellex\DragDropHandlers\7-Zip	7z2201-x64.exe

NTFS ADS 2 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03.rar:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2201-x64.exe:Zone.Identifier	firefox.exe

Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

3816 regedit.exe

pid	process
3816	regedit.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

Mercurial.exeMercurial.exeMercurial.exe

pid	process
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
1484	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3736	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe
3416	Mercurial.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

7zFM.exeregedit.exe

pid process

4312 7zFM.exe
3816 regedit.exe

pid	process
4312	7zFM.exe
3816	regedit.exe

Suspicious use of AdjustPrivilegeToken 36 IoCs

Processes:

Mercurial.exefirefox.exeAUDIODG.EXEfirefox.exe7zG.exe7zFM.exeMercurial.exeMercurial.exeNebulaSetup.exeAUDIODG.EXENebulaSetup.exeNebulaSetup.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	1484	Mercurial.exe
Token: SeDebugPrivilege	4308	firefox.exe
Token: SeDebugPrivilege	4308	firefox.exe
Token: 33	3220	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3220	AUDIODG.EXE
Token: SeDebugPrivilege	4308	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeRestorePrivilege	1460	7zG.exe
Token: 35	1460	7zG.exe
Token: SeSecurityPrivilege	1460	7zG.exe
Token: SeSecurityPrivilege	1460	7zG.exe
Token: SeRestorePrivilege	4312	7zFM.exe
Token: 35	4312	7zFM.exe
Token: SeSecurityPrivilege	4312	7zFM.exe
Token: SeDebugPrivilege	3736	Mercurial.exe
Token: SeDebugPrivilege	3416	Mercurial.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	704	NebulaSetup.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: 33	4592	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4592	AUDIODG.EXE
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	1372	firefox.exe
Token: SeDebugPrivilege	644	NebulaSetup.exe
Token: SeDebugPrivilege	216	NebulaSetup.exe
Token: SeDebugPrivilege	540	firefox.exe
Token: SeDebugPrivilege	540	firefox.exe
Token: SeDebugPrivilege	540	firefox.exe
Token: SeDebugPrivilege	540	firefox.exe
Token: SeDebugPrivilege	540	firefox.exe
Token: SeDebugPrivilege	540	firefox.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

firefox.exefirefox.exe7zG.exe7zFM.exeMercurial.exefirefox.exe

pid	process
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1460	7zG.exe
4312	7zFM.exe
4312	7zFM.exe
3736	Mercurial.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe

Suspicious use of SendNotifyMessage 17 IoCs

Processes:

firefox.exefirefox.exefirefox.exe

pid	process
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe
540	firefox.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

firefox.exe7z2201-x64.exe7z2201-x64.exefirefox.exeregedit.exefirefox.exe

pid	process
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4308	firefox.exe
4452	7z2201-x64.exe
2468	7z2201-x64.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
1372	firefox.exe
3816	regedit.exe
3816	regedit.exe
3816	regedit.exe
3816	regedit.exe
540	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4604 wrote to memory of 4308	4604	firefox.exe	firefox.exe
PID 4308 wrote to memory of 4388	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 4388	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 3056	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 2348	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 2348	4308	firefox.exe	firefox.exe
PID 4308 wrote to memory of 2348	4308	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Mercurial.exe
"C:\Users\Admin\AppData\Local\Temp\Mercurial.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1484
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1080
  2⤵
  - Program crash
  PID:3892
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1484 -s 1512
  2⤵
  - Program crash
  PID:5000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.0.1067285243\46533827" -parentBuildID 20221007134813 -prefsHandle 1816 -prefMapHandle 1808 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adf49d33-5608-45e8-a12f-c6083a6784ac} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 1908 270b44ecb58 gpu
    3⤵
    PID:4388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.1.1635970855\1846211760" -parentBuildID 20221007134813 -prefsHandle 2296 -prefMapHandle 2292 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44a569be-87ba-427c-aaba-770aa54540c0} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 2308 270a7571958 socket
    3⤵
    - Checks processor information in registry
    PID:3056
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.2.2007372565\1385662000" -childID 1 -isForBrowser -prefsHandle 3132 -prefMapHandle 3128 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c9258ecf-3e07-4d63-8a24-6e2fbd8d1961} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 3000 270b81ea558 tab
    3⤵
    PID:2348
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.3.1968551024\894320823" -childID 2 -isForBrowser -prefsHandle 3616 -prefMapHandle 3612 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {00db634c-6c22-48a9-bdeb-02663239d2e3} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 3136 270a7561c58 tab
    3⤵
    PID:3780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.4.791977873\1891623231" -childID 3 -isForBrowser -prefsHandle 4136 -prefMapHandle 3616 -prefsLen 26578 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daf36000-a420-4a0f-b6b6-faea8e52672c} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 4444 270ba437558 tab
    3⤵
    PID:3368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.6.2110377506\1873162085" -childID 5 -isForBrowser -prefsHandle 5080 -prefMapHandle 5012 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daa20dda-ab29-4e5c-8372-3ca9d81a411f} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5112 270badc5858 tab
    3⤵
    PID:4640
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.5.1367238829\1366216730" -childID 4 -isForBrowser -prefsHandle 5056 -prefMapHandle 2716 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {63e7cd34-8240-426a-80c3-13658a9c1b26} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 2708 270ba5dc458 tab
    3⤵
    PID:2040
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.7.1695881245\841548441" -childID 6 -isForBrowser -prefsHandle 5476 -prefMapHandle 5420 -prefsLen 26659 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3610640e-dc94-437c-80ab-2f18699394a1} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5080 270badc7658 tab
    3⤵
    PID:2376
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.8.1713316784\738864850" -childID 7 -isForBrowser -prefsHandle 5932 -prefMapHandle 5928 -prefsLen 26834 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c588030b-7b26-45c3-b241-a80576766b27} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5916 270bad9a858 tab
    3⤵
    PID:3820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.9.1267424526\428943085" -childID 8 -isForBrowser -prefsHandle 5236 -prefMapHandle 6216 -prefsLen 27235 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {06710dae-ffbc-4c84-a323-9f9ec0386b92} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5192 270bb61a458 tab
    3⤵
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4308.10.1043278984\1359836410" -childID 9 -isForBrowser -prefsHandle 5232 -prefMapHandle 2804 -prefsLen 27235 -prefMapSize 232675 -jsInitHandle 1476 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3bbfe105-6769-4e0e-bc86-7e13276f3e01} 4308 "\\.\pipe\gecko-crash-server-pipe.4308" 5316 270a756c158 tab
    3⤵
    PID:4368
- - C:\Users\Admin\Downloads\7z2201-x64.exe
    "C:\Users\Admin\Downloads\7z2201-x64.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4452

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x390
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1484 -ip 1484
1⤵
PID:3960

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1484 -ip 1484
1⤵
PID:2580

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3844

C:\Users\Admin\Downloads\7z2201-x64.exe
"C:\Users\Admin\Downloads\7z2201-x64.exe"
1⤵
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4048
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:1372
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.0.1545108982\2013496532" -parentBuildID 20221007134813 -prefsHandle 1708 -prefMapHandle 1532 -prefsLen 20890 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {343a1f60-04c4-45f1-b21b-b00daa49500e} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 1788 1ca93a0b158 gpu
    3⤵
    PID:3244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.1.1454757210\1807024495" -parentBuildID 20221007134813 -prefsHandle 2132 -prefMapHandle 2128 -prefsLen 20890 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aabbcb93-5b8a-4093-ad6e-a010a2f1167d} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 2144 1ca93ad6558 socket
    3⤵
    - Checks processor information in registry
    PID:520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.2.1551184087\152012001" -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 21437 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1904a298-4b89-462b-a4ec-eb2ab68b6d71} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 3160 1ca96fdd358 tab
    3⤵
    PID:2204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.3.2005630228\77233457" -childID 2 -isForBrowser -prefsHandle 3904 -prefMapHandle 3900 -prefsLen 26049 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a6f01feb-98a8-4411-b003-d9f8fcbd99bc} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 3916 1ca86e62858 tab
    3⤵
    PID:1184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.4.1150825155\632198426" -childID 3 -isForBrowser -prefsHandle 4088 -prefMapHandle 4100 -prefsLen 26829 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0855792c-b42b-4bd4-9df5-bf1bedc82e7f} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4196 1ca949ac158 tab
    3⤵
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.5.355759944\165522006" -childID 4 -isForBrowser -prefsHandle 4396 -prefMapHandle 4400 -prefsLen 26888 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {267554d1-a1c9-45cd-b6a9-ffa82a81dd2f} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4772 1ca86e6a558 tab
    3⤵
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.6.1854823011\1378828282" -childID 5 -isForBrowser -prefsHandle 4956 -prefMapHandle 5308 -prefsLen 27144 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {28a51158-dd1d-41f5-ab69-95ad2e35c279} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5304 1ca9a442f58 tab
    3⤵
    PID:1752
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.8.1914702940\1236571542" -childID 7 -isForBrowser -prefsHandle 4860 -prefMapHandle 4844 -prefsLen 27144 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d794bef1-9834-4ab9-99cd-8c30c63fb278} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5644 1ca9ac36258 tab
    3⤵
    PID:3200
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.9.1914555920\361935991" -childID 8 -isForBrowser -prefsHandle 5336 -prefMapHandle 5308 -prefsLen 27144 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1855413-5531-4bfe-a563-c15359caa884} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5464 1ca9ac36e58 tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.7.1692265269\467523511" -childID 6 -isForBrowser -prefsHandle 4880 -prefMapHandle 4800 -prefsLen 27144 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ec9d3be9-1c63-4dd3-804b-2f5d0ca90c50} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5548 1ca9ac35c58 tab
    3⤵
    PID:2840
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.10.1548136377\1579400569" -childID 9 -isForBrowser -prefsHandle 4956 -prefMapHandle 4816 -prefsLen 27144 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2395409d-11df-4f25-a06b-d0fd95d10143} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5524 1ca9adedd58 tab
    3⤵
    PID:3344
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.11.1542549539\1440897806" -childID 10 -isForBrowser -prefsHandle 5508 -prefMapHandle 5512 -prefsLen 27240 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bb84a955-9341-4a48-85e7-c72195f5421d} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5260 1ca970f1d58 tab
    3⤵
    PID:728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.12.561170560\764795255" -childID 11 -isForBrowser -prefsHandle 6572 -prefMapHandle 6616 -prefsLen 30717 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b384c49a-dbdf-4939-ab72-7cce07478a25} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6604 1caa15c3e58 tab
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.13.1958588761\2104984706" -childID 12 -isForBrowser -prefsHandle 6560 -prefMapHandle 6584 -prefsLen 30717 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7ad5f2d6-015b-437e-9ef4-95eaf3edfedd} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6768 1caa1568d58 tab
    3⤵
    PID:5068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.14.1082175683\1171399823" -parentBuildID 20221007134813 -prefsHandle 4884 -prefMapHandle 6028 -prefsLen 30717 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a8553f7f-4914-40e0-bb61-b44e6fc2a1ae} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6016 1ca86e60758 rdd
    3⤵
    PID:1780
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.15.351409943\1646551168" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5488 -prefMapHandle 5904 -prefsLen 30717 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f9e5554-286a-434b-a858-fbd61b38ba2e} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 7104 1ca99bd9658 utility
    3⤵
    PID:2184
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.16.1344038310\173725987" -childID 13 -isForBrowser -prefsHandle 5756 -prefMapHandle 5564 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c45ddc-f4c3-4747-b04b-132f37e6ca13} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 5460 1caa3663f58 tab
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.19.687230543\2116389285" -childID 16 -isForBrowser -prefsHandle 4972 -prefMapHandle 4352 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9f85d639-ec02-4c1b-8799-695d53806df8} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6992 1ca9b650258 tab
    3⤵
    PID:404
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.18.184165667\999166745" -childID 15 -isForBrowser -prefsHandle 6844 -prefMapHandle 6848 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {07314c65-ac18-4124-8830-2a009eb47842} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6796 1ca9b64f058 tab
    3⤵
    PID:4480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.17.1759266387\619560750" -childID 14 -isForBrowser -prefsHandle 4196 -prefMapHandle 3468 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {94c5da09-8716-43e2-9db3-fa1f2f0e18a3} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4352 1ca9b64f658 tab
    3⤵
    PID:4872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.20.1927176749\1547690191" -childID 17 -isForBrowser -prefsHandle 7288 -prefMapHandle 7284 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d48fe31-32a0-4c38-817e-4e787ecf434c} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 7296 1ca9ab84858 tab
    3⤵
    PID:2484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.21.888015138\1548464692" -childID 18 -isForBrowser -prefsHandle 4084 -prefMapHandle 4092 -prefsLen 30726 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f9e3cd3-220f-49bc-8586-d917c58a9500} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6728 1ca9ab84558 tab
    3⤵
    PID:872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.22.648868066\1778621122" -childID 19 -isForBrowser -prefsHandle 6468 -prefMapHandle 5732 -prefsLen 30735 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b14f1665-a2e7-4694-875b-9683cb89bb4d} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4092 1ca9faf8658 tab
    3⤵
    PID:4272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.23.1114831301\2066180843" -childID 20 -isForBrowser -prefsHandle 5680 -prefMapHandle 5704 -prefsLen 30735 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {744e461b-94e8-4634-acc5-305d12311746} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 4840 1ca86e5e258 tab
    3⤵
    PID:3936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.25.711424391\616786658" -childID 22 -isForBrowser -prefsHandle 11132 -prefMapHandle 11128 -prefsLen 30735 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d9ef5c6-d7f8-4197-880f-ffd2119d3d25} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 11140 1ca9afc8a58 tab
    3⤵
    PID:3236
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.24.690083586\997846619" -childID 21 -isForBrowser -prefsHandle 11300 -prefMapHandle 10960 -prefsLen 30735 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f4fec655-daeb-4603-a691-25c82a78e051} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 11292 1ca9afc8458 tab
    3⤵
    PID:4908
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.27.2073240369\1424525571" -childID 24 -isForBrowser -prefsHandle 6848 -prefMapHandle 11260 -prefsLen 30744 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc07fb8a-a546-4e63-a883-0e5ff4482efa} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 6520 1ca9ad0c758 tab
    3⤵
    PID:772
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.26.1805059215\332261945" -childID 23 -isForBrowser -prefsHandle 10820 -prefMapHandle 10876 -prefsLen 30744 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b9166ee1-be16-48ca-ab75-9aea68c03c28} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 10804 1ca9ad0c158 tab
    3⤵
    PID:4600
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1372.28.758705368\1111750061" -childID 25 -isForBrowser -prefsHandle 10580 -prefMapHandle 6848 -prefsLen 30744 -prefMapSize 232711 -jsInitHandle 1392 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d173b874-22ef-49a8-a222-483508ca9424} 1372 "\\.\pipe\gecko-crash-server-pipe.1372" 10588 1ca9ad0e258 tab
    3⤵
    PID:1772

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap11185:108:7zEvent17236
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1460

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\Mercurial.Grabber.v1.03.rar"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4312

C:\Users\Admin\Downloads\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 1756
  2⤵
  - Program crash
  PID:4704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3736 -s 2132
  2⤵
  - Program crash
  PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3736 -ip 3736
1⤵
PID:3288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3736 -ip 3736
1⤵
PID:4816

C:\Users\Admin\Downloads\Mercurial.exe
"C:\Users\Admin\Downloads\Mercurial.exe"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3416
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\20s04nhp\20s04nhp.cmdline"
  2⤵
  PID:2124
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C88.tmp" "c:\Users\Admin\Downloads\CSC97403635513A46E68978E6F8664753E3.TMP"
    3⤵
    PID:1704
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 2336
  2⤵
  - Program crash
  PID:3396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 2336
  2⤵
  - Program crash
  PID:2060

C:\Users\Admin\Downloads\NebulaSetup.exe
"C:\Users\Admin\Downloads\NebulaSetup.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:704

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3d4 0x390
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3416 -ip 3416
1⤵
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 3416 -ip 3416
1⤵
PID:1016

C:\Users\Admin\Downloads\NebulaSetup.exe
"C:\Users\Admin\Downloads\NebulaSetup.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:644

C:\Users\Admin\Downloads\NebulaSetup.exe
"C:\Users\Admin\Downloads\NebulaSetup.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:216

C:\Windows\regedit.exe
"C:\Windows\regedit.exe"
1⤵
- Runs regedit.exe
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3816

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3596
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:540
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.0.1597097030\81777296" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20890 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {97cb838d-1b8a-4a52-bec3-929502e32710} 540 "\\.\pipe\gecko-crash-server-pipe.540" 1780 1d3e4b0c358 gpu
    3⤵
    PID:636
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.1.2031423387\454597685" -parentBuildID 20221007134813 -prefsHandle 2132 -prefMapHandle 2128 -prefsLen 20890 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd67e9d4-7d42-45ac-9927-9ea3dddbd2d3} 540 "\\.\pipe\gecko-crash-server-pipe.540" 2144 1d3e4449258 socket
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.2.1884182949\578567255" -childID 1 -isForBrowser -prefsHandle 3076 -prefMapHandle 3052 -prefsLen 21437 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {69fa91b4-f05f-4f29-bf02-70d9a57b2efe} 540 "\\.\pipe\gecko-crash-server-pipe.540" 3080 1d3e89d5958 tab
    3⤵
    PID:3096
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.3.576959096\1055584170" -childID 2 -isForBrowser -prefsHandle 4060 -prefMapHandle 4056 -prefsLen 26829 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8efb35a3-6d07-4ca6-9728-eedfa8a16059} 540 "\\.\pipe\gecko-crash-server-pipe.540" 4072 1d3eabbee58 tab
    3⤵
    PID:1420
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.4.1866798066\1400410290" -childID 3 -isForBrowser -prefsHandle 4692 -prefMapHandle 4676 -prefsLen 29265 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {abeffa21-8c2e-4fd1-b389-47b056168579} 540 "\\.\pipe\gecko-crash-server-pipe.540" 4764 1d3e8925858 tab
    3⤵
    PID:2732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.6.1477674165\1972652240" -childID 5 -isForBrowser -prefsHandle 5092 -prefMapHandle 5096 -prefsLen 29265 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7e629193-7876-4ddf-bacb-a1e5f9893095} 540 "\\.\pipe\gecko-crash-server-pipe.540" 4748 1d3ecbad258 tab
    3⤵
    PID:3428
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.5.937254705\1084849061" -childID 4 -isForBrowser -prefsHandle 4908 -prefMapHandle 4912 -prefsLen 29265 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38b7e143-a750-4ee9-90d3-4a968b95a8ec} 540 "\\.\pipe\gecko-crash-server-pipe.540" 4904 1d3ecbacf58 tab
    3⤵
    PID:1492
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.7.337599476\300440531" -childID 6 -isForBrowser -prefsHandle 5520 -prefMapHandle 3196 -prefsLen 29519 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c33278e4-425a-41cd-a551-1ce85977c8a2} 540 "\\.\pipe\gecko-crash-server-pipe.540" 5528 1d3ee8cd758 tab
    3⤵
    PID:1864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.8.2074432024\638886313" -parentBuildID 20221007134813 -prefsHandle 5732 -prefMapHandle 5728 -prefsLen 29519 -prefMapSize 232711 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b180745a-f5d6-4924-91e4-2dc1eb28db55} 540 "\\.\pipe\gecko-crash-server-pipe.540" 5708 1d3ecd40b58 rdd
    3⤵
    PID:1988
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.9.403860893\1227414691" -childID 7 -isForBrowser -prefsHandle 5884 -prefMapHandle 5908 -prefsLen 29519 -prefMapSize 232711 -jsInitHandle 1420 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {957f12da-e4c0-4136-9683-5c135753c1ec} 540 "\\.\pipe\gecko-crash-server-pipe.540" 5888 1d3e4e2e458 tab
    3⤵
    PID:1304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="540.10.1782540199\436513774" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6076 -prefMapHandle 6080 -prefsLen 29519 -prefMapSize 232711 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc2eb006-9193-47b0-91c2-60948f49be2d} 540 "\\.\pipe\gecko-crash-server-pipe.540" 6108 1d3e4ecc058 utility
    3⤵
    PID:3628

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Virtualization/Sandbox Evasion