4dcba938617dc31c366a7bc49b8a231b935c5553c8eb645b39d0f805c37160d9

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.122\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe	BraveUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0"	BraveUpdate.exe

Checks computer location settings 2 TTPs 13 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	BraveUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	brave.exe

Executes dropped EXE 64 IoCs

pid	Process
5612	BraveBrowserSetup-BRV010.exe
3676	BraveUpdate.exe
5656	BraveUpdate.exe
1108	BraveUpdate.exe
4816	BraveUpdateComRegisterShell64.exe
2620	BraveUpdateComRegisterShell64.exe
6136	BraveUpdateComRegisterShell64.exe
5152	BraveUpdate.exe
5688	BraveUpdate.exe
5368	BraveUpdate.exe
4840	brave_installer-x64.exe
4984	setup.exe
64	setup.exe
2288	brave_vpn_helper.exe
5020	setup.exe
1692	setup.exe
3972	brave_vpn_helper.exe
5976	brave.exe
5964	brave.exe
3584	brave.exe
6012	brave.exe
3936	brave.exe
3628	brave.exe
1408	brave.exe
2480	brave.exe
232	brave.exe
5272	brave.exe
4408	brave.exe
4528	brave.exe
4348	brave.exe
4664	brave.exe
5164	brave.exe
4176	brave.exe
4872	brave.exe
5364	brave.exe
3680	brave.exe
4928	brave.exe
2840	brave.exe
448	brave.exe
1976	brave.exe
6352	brave.exe
5520	brave.exe
10008	brave.exe
6264	brave.exe
1496	brave.exe
6292	brave.exe
6184	brave.exe
6284	chrmstp.exe
6908	chrmstp.exe
8052	chrmstp.exe
6964	chrmstp.exe
3728	brave.exe
7132	brave.exe
7164	brave.exe
4044	brave.exe
2616	brave.exe
3752	brave.exe
7336	BraveUpdate.exe
7428	brave.exe
9136	brave.exe
10124	brave.exe
9492	brave.exe
9664	brave.exe
9884	brave.exe

Loads dropped DLL 64 IoCs

pid	Process
3676	BraveUpdate.exe
5656	BraveUpdate.exe
1108	BraveUpdate.exe
4816	BraveUpdateComRegisterShell64.exe
1108	BraveUpdate.exe
2620	BraveUpdateComRegisterShell64.exe
1108	BraveUpdate.exe
6136	BraveUpdateComRegisterShell64.exe
1108	BraveUpdate.exe
5152	BraveUpdate.exe
5688	BraveUpdate.exe
5368	BraveUpdate.exe
5368	BraveUpdate.exe
5688	BraveUpdate.exe
5976	brave.exe
5964	brave.exe
3584	brave.exe
6012	brave.exe
3584	brave.exe
5976	brave.exe
3936	brave.exe
3936	brave.exe
3628	brave.exe
3936	brave.exe
3936	brave.exe
3936	brave.exe
3936	brave.exe
3936	brave.exe
3628	brave.exe
1408	brave.exe
2480	brave.exe
232	brave.exe
232	brave.exe
1408	brave.exe
2480	brave.exe
1408	brave.exe
1408	brave.exe
1408	brave.exe
1408	brave.exe
1408	brave.exe
5272	brave.exe
5272	brave.exe
4408	brave.exe
4408	brave.exe
4528	brave.exe
4348	brave.exe
4528	brave.exe
4348	brave.exe
4664	brave.exe
4664	brave.exe
5164	brave.exe
4176	brave.exe
4176	brave.exe
4872	brave.exe
4872	brave.exe
5164	brave.exe
5364	brave.exe
5364	brave.exe
4928	brave.exe
4928	brave.exe
3680	brave.exe
3680	brave.exe
2840	brave.exe
2840	brave.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.122\\notification_helper.exe\""	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.122\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in System32 directory 20 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\amd64\SET36BF.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scpvbus.inf_amd64_21ca245c0e23d7a5\ScpVBus.PNF	ScpDriver.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\SET36AE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	ScpDriver.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scpvbus.inf_amd64_21ca245c0e23d7a5\scpvbus.PNF	ScpDriver.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\amd64	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\SET36AE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\SET36BE.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\SET36BE.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\ScpVBus.inf	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\scpvbus.inf_amd64_21ca245c0e23d7a5\amd64\ScpVBus.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\scpvbus.inf_amd64_21ca245c0e23d7a5\ScpVBus.inf	DrvInst.exe
File created	\??\c:\windows\system32\driverstore\filerepository\scpvbus.inf_amd64_21ca245c0e23d7a5\scpvbus.PNF	ScpDriver.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\ScpVBus.cat	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\amd64\SET36BF.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\amd64\ScpVBus.sys	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\scpvbus.inf_amd64_21ca245c0e23d7a5\ScpVBus.cat	DrvInst.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\xGamma.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\5U9QqCPhqXAJcEv9uyzFJd5zhN93vuPk1aNNkXnUfPnt.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\yield-logo.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\DFL1zNkaGPWm1BqAVqRjCZvHmwTFrEaJtbzJWgseoNJh.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\gear.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\bacon.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\github\_locales\fa\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\mIAU.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\ic_token_ibtc.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\A7rqejP8LKN8syXMr4tvcKjs2iJ4WtZjXNs1e6qP3m9g.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\reddit\_locales\da\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\block-chain.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\BABYsocP6cB95xvBDXnjXKX96VBNC37dmNWUtaV9Jk6v.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\TRB.png	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMDE01.tmp\BraveCrashHandler.exe	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\DAtU322C23YpoZyWBm8szk12QyqHa9rUQe1EYXzbm1JE.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\hunt.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\github\_locales\am\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\5gs8nf4wojB5EXgDUWNLwXpknzgV2YWDhveAeBZpVLbp.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\unWBTC.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\fujiCeCeP9AFDVCv27P5JRcKLoH7wfs2C9xmDECs24m.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_49702963\crl-set	brave.exe
File opened for modification	C:\Program Files\BraveSoftware\Brave-Browser\Application\SetupMetrics\71d972e7-d26c-4ca8-b2b4-3ad231927db7.tmp	chrmstp.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMDE01.tmp\goopdateres_ur.dll	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4984_1990807344\Chrome-bin\114.1.52.122\resources\brave_extension\_locales\sk\messages.json	setup.exe
File opened for modification	C:\Program Files (x86)\BraveSoftware\Temp\GUTDE02.tmp	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\twitter\_locales\fi\messages.json	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_en.dll	BraveUpdate.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\Czt7Fc4dz6BpLh2vKiSYyotNK2uPPDhvbWrrLeD9QxhV.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_1130239943\aleks-eva-1.jpg	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\HysWcbHiYY9888pHbaqhwLYZQeZrcQMXKQWRqS7zcPK5.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\HxhWkVpk5NS4Ltg5nij2G671CKXFRKPK8vy271Ub4uEK.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\FgX1WD9WzMU3yLwXaFSarPfkgzjLb2DZCqmkx9ExpuvJ.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\reddit\_locales\ko\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\twitter\_locales\no\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\DSXWF79VQ3RzFBB67WeNfCzfzAQq5X6m97zi85bq1TRx.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\reddit\_locales\ca\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\wyvern-logo.png	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4984_1990807344\Chrome-bin\114.1.52.122\resources\brave_extension\_locales\sr\messages.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\sYFL.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\4tJZhSdGePuMEfZQ3h5LaHjTPsw1iWTRFTojnZcwsAU6.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\github\_locales\mr\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\7xKXtg2CW87d97TXJSDpbD5jBkheTqA83TZRuJosgAsU.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\github\_locales\te\messages.json	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4984_1990807344\Chrome-bin\114.1.52.122\resources\brave_extension\_locales\fa\messages.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\J7WYVzFNynk9D28eBCccw2EYkygygiLDCVCabV7CupWL.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\rivetz.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\HtbhBYdcfXbbD2JiH6jtsTt2m2FXjn7h4k6iXfz98k5W.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\OVR.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\shina.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\plr.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\octo82drBEdm8CSDaEKBymVn86TBtgmPnDdmE64PTqJ.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_296752977\1\scripts\brave_rewards\publisher\reddit\_locales\en_GB\messages.json	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4984_1990807344\Chrome-bin\114.1.52.122\Locales\en-GB.pak	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\contract-map.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\3fXCWpQaEHEsnHSYAqcxm3QLPGLxYiZzoJbqRY9wWxV2.png	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_da.dll	BraveUpdate.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\gth.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\Ac7GiHwC7vZU2y97GRh9rqCqqnKAAgopYrTAtKccHxUk.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\SYLO.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\tkn.png	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source4984_1990807344\Chrome-bin\114.1.52.122\resources\brave_extension\_locales\el\messages.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\synthetix.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping3584_745015005\images\5v6tZ1SiAi7G8Qg4rBF1ZdAn4cn6aeQtefewMr1NLy61.png	brave.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\INF\setupapi.dev.log	ScpDriver.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\inf\oem3.inf	DrvInst.exe
File created	C:\Windows\INF\oem3.PNF	ScpDriver.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 62 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	ScpDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	ScpDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	ScpDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ScpDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Filters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	ScpDriver.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ScpDriver.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	DrvInst.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	brave.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	brave.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	brave.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	brave.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	brave.exe

Modifies data under HKEY_USERS 44 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	brave.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133307314200898482"	brave.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ = "ICoCreateAsyncStatus"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher\CurVer	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusSvc\CLSID	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreClass.1	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{24D704AD-AC42-49F2-BB4F-68BA77C98E91}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine.dll"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\ = "IPolicyStatusValue"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\ = "IGoogleUpdate3Web"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\Elevation	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ = "ICredentialDialog"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\BraveUpdateOnDemand.exe\""	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\NumMethods\ = "17"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\VersionIndependentProgID\ = "BraveSoftwareUpdate.OnDemandCOMClassMachineFallback"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{35A4470F-5EEC-4715-A2DC-6AA9F8E21183}\ = "IAppVersionWeb"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveFile\Application\ApplicationDescription = "Access the Internet"	setup.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	brave.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91B050A9-5A49-4249-A8C8-B4390961A912}\NumMethods\ = "4"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachineFallback.1.0\ = "Google Update Policy Status Class"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\ = "IAppCommand2"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ProxyStubClsid32\ = "{CCB5968D-10A4-423E-9D7A-4A4E600B716D}"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.ProcessLauncher.1.0	BraveUpdate.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C9190589-ECEC-43F8-8AEC-62496BB87B26}\NumMethods\ = "8"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\ProxyStubClsid32\ = "{CCB5968D-10A4-423E-9D7A-4A4E600B716D}"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\ProxyStubClsid32\ = "{CCB5968D-10A4-423E-9D7A-4A4E600B716D}"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\BraveUpdateBroker.exe\""	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\NumMethods\ = "43"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BraveFile\shell\open\command	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods\ = "13"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods\ = "12"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C663DEBB-F082-4971-9F6E-35DE45C96F4E}\ = "IPackage"	BraveUpdateComRegisterShell64.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{00B16F95-319A-4F01-AC81-CE69B8F4E387}\Elevation\Enabled = "1"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoCreateAsync\CLSID\ = "{8F6D9FE5-6ED3-43A3-80D2-EA8766D65352}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C11C073F-E6D0-4EF7-897B-AAF52498CD2F}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}\ = "IAppVersion"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\ = "IGoogleUpdate"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	brave.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32\ = "{CCB5968D-10A4-423E-9D7A-4A4E600B716D}"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ProxyStubClsid32\ = "{CCB5968D-10A4-423E-9D7A-4A4E600B716D}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\ = "IBrowserHttpRequest2"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Interface\{B7965C30-7D58-4D86-9E18-4794256409EE}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveFile\Application\ApplicationIcon = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe,0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\BraveUpdate.exe\AppID = "{D7D7525F-5DF4-4C9D-8781-C02F39F973E6}"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCB5968D-10A4-423E-9D7A-4A4E600B716D}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUMDE01.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateSetup.exe\:Zone.Identifier:$DATA	BraveUpdate.exe
File created	C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3584	brave.exe
3584	brave.exe
5688	BraveUpdate.exe
5688	BraveUpdate.exe
5688	BraveUpdate.exe
5688	BraveUpdate.exe
7336	BraveUpdate.exe
7336	BraveUpdate.exe
4200	brave.exe
4200	brave.exe
6768	BraveUpdate.exe
6768	BraveUpdate.exe
7044	BraveUpdate.exe
7044	BraveUpdate.exe
3844	BraveUpdate.exe
3844	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe
3676	BraveUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	1784	firefox.exe
Token: SeDebugPrivilege	3676	BraveUpdate.exe
Token: SeDebugPrivilege	3676	BraveUpdate.exe
Token: SeDebugPrivilege	3676	BraveUpdate.exe
Token: SeDebugPrivilege	3676	BraveUpdate.exe
Token: 33	4840	brave_installer-x64.exe
Token: SeIncBasePriorityPrivilege	4840	brave_installer-x64.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	5020	setup.exe
Token: SeDebugPrivilege	4984	setup.exe
Token: SeDebugPrivilege	4984	setup.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: 33	3140	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3140	AUDIODG.EXE
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe
Token: SeShutdownPrivilege	3584	brave.exe
Token: SeCreatePagefilePrivilege	3584	brave.exe

Suspicious use of FindShellTrayWindow 21 IoCs

pid	Process
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe
5020	setup.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
8052	chrmstp.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
3584	brave.exe
8916	7zG.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe
1784	firefox.exe
8312	brave.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 2720 wrote to memory of 1784	2720	firefox.exe	89
PID 1784 wrote to memory of 2804	1784	firefox.exe	92
PID 1784 wrote to memory of 2804	1784	firefox.exe	92
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2552	1784	firefox.exe	94
PID 1784 wrote to memory of 2592	1784	firefox.exe	95
PID 1784 wrote to memory of 2592	1784	firefox.exe	95
PID 1784 wrote to memory of 2592	1784	firefox.exe	95

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\download.png
1⤵
PID:1628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.0.1267834173\568305313" -parentBuildID 20221007134813 -prefsHandle 1828 -prefMapHandle 1820 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {770cfbe3-e5c8-444f-9f0e-43c64fce1154} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 1908 18473f16858 gpu
    3⤵
    PID:2804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.1.1683616401\1886294157" -parentBuildID 20221007134813 -prefsHandle 2292 -prefMapHandle 2296 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cb10a22c-e4e0-4165-a341-b11ec8f47590} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 2308 18465f70a58 socket
    3⤵
    - Checks processor information in registry
    PID:2552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.2.1457135117\2132940587" -childID 1 -isForBrowser -prefsHandle 2836 -prefMapHandle 2940 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {65253efe-d967-4a66-8422-427815249a11} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 2948 18476d27158 tab
    3⤵
    PID:2592
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.3.1883952919\1296141703" -childID 2 -isForBrowser -prefsHandle 1276 -prefMapHandle 3320 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1152b955-0eed-4755-9680-766b6628d1ea} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 3432 18465f65958 tab
    3⤵
    PID:2104
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.4.485510028\1894003705" -childID 3 -isForBrowser -prefsHandle 4020 -prefMapHandle 4016 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d2c2bfc-9c00-4d40-8765-e2608bf0848d} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 4056 18465f62558 tab
    3⤵
    PID:3800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.7.867699269\106035158" -childID 6 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1030d171-5f26-4a1e-a7ec-fee7e4c5baf5} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5348 184791ee558 tab
    3⤵
    PID:1836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.6.78466000\1919320699" -childID 5 -isForBrowser -prefsHandle 5144 -prefMapHandle 4868 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a1cd70b1-6328-404b-8171-d0de027ff2f1} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5124 184791ef758 tab
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.5.414909067\188626396" -childID 4 -isForBrowser -prefsHandle 5032 -prefMapHandle 4856 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {513297d2-e4dc-4243-8e6b-366a3bc7a15c} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5016 18477ae7f58 tab
    3⤵
    PID:2652
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.8.1042216664\478647990" -childID 7 -isForBrowser -prefsHandle 5840 -prefMapHandle 5880 -prefsLen 26832 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6fbb8ac-d8a5-4097-9be7-bb9ae7a4a921} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5580 1847b57f058 tab
    3⤵
    PID:1728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1784.9.765296682\1674109617" -childID 8 -isForBrowser -prefsHandle 5836 -prefMapHandle 3600 -prefsLen 26849 -prefMapSize 232675 -jsInitHandle 1492 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1aa957b3-ef29-40e1-b23b-9fe8d9052a7e} 1784 "\\.\pipe\gecko-crash-server-pipe.1784" 5028 18472f10758 tab
    3⤵
    PID:5780
- - C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe
    "C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - NTFS ADS
    PID:5612
  - - C:\Program Files (x86)\BraveSoftware\Temp\GUMDE01.tmp\BraveUpdate.exe
      "C:\Program Files (x86)\BraveSoftware\Temp\GUMDE01.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"
      4⤵
      Sets file execution options in registry
      Checks computer location settings
      Executes dropped EXE
      Loads dropped DLL
      Drops file in Program Files directory
      NTFS ADS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3676
    - - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:5656
    - - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Modifies registry class
        
        PID:1108
      - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:4816
      - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:2620
      - C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Registers COM server for autorun
        Modifies registry class
        
        PID:6136
    - - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5QzBGMzcyNy05Q0MxLTQ4NTEtQjhGRC1GRURFMUU2Nzg5Mzh9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7RkVDN0E2RDAtNDJDRC00RDg5LUEyQkEtM0Q2ODBCOEMzNTk2fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjEzNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIyMjM3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:5152
    - - C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource taggedmi /sessionid "{9C0F3727-9CC1-4851-B8FD-FEDE1E678938}"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious behavior: EnumeratesProcesses
        
        PID:5688

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5368
- C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\brave_installer-x64.exe
  "C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\brave_installer-x64.exe" --do-not-launch-chrome
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- - C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe
    "C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome --brave-referral-code="BRV010"
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Registers COM server for autorun
    - Drops file in Program Files directory
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
  - - C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff695bca9f8,0x7ff695bcaa08,0x7ff695bcaa18
      4⤵
      Executes dropped EXE
      PID:64
  - - C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\brave_vpn_helper.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\brave_vpn_helper.exe" --install
      4⤵
      Executes dropped EXE
      PID:2288
    - - C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\brave_vpn_helper.exe
        
        "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\brave_vpn_helper.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\BraveSoftware\BraveVpnService /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\BraveSoftware\BraveVpnService\Crashpad --metrics-dir=C:\ProgramData\BraveSoftware\BraveVpnService --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=BraveVpnService --annotation=ver=114.1.52.122 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff7557864a8,0x7ff7557864b8,0x7ff7557864c8
        5⤵
        Executes dropped EXE
        
        PID:3972
  - - C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe
      "C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
      4⤵
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:5020
    - - C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe
        
        "C:\Program Files (x86)\BraveSoftware\Update\Install\{05DE8005-519C-432E-B300-7612200C7B84}\CR_E41B1.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0x264,0x268,0x26c,0x248,0x270,0x7ff695bca9f8,0x7ff695bcaa08,0x7ff695bcaa18
        5⤵
        Executes dropped EXE
        
        PID:1692
- C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins5QzBGMzcyNy05Q0MxLTQ4NTEtQjhGRC1GRURFMUU2Nzg5Mzh9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NUI5RUJCNkEtOUVERi00NTRDLTk1MEMtRjM5MEI2QzhCNTc1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntBRkU2QTQ2Mi1DNTc0LTRCOEEtQUY0My00Q0M2MERGNDU2M0J9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTQuMS41Mi4xMjIiIGFwPSJ4NjQtcmVsIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly91cGRhdGVzLWNkbi5icmF2ZXNvZnR3YXJlLmNvbS9idWlsZC9CcmF2ZS1SZWxlYXNlL3g2NC1yZWwvd2luLzExNC4xLjUyLjEyMi9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTA3ODA3MjU2IiB0b3RhbD0iMTA3ODA3MjU2IiBkb3dubG9hZF90aW1lX21zPSIxNDA0NyIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSI2IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMTk2NzA3IiBzb3VyY2VfdXJsX2luZGV4PSIwIiB1cGRhdGVfY2hlY2tfdGltZV9tcz0iNDIxIiBkb3dubG9hZF90aW1lX21zPSIxNTU5NCIgZG93bmxvYWRlZD0iMTA3ODA3MjU2IiB0b3RhbD0iMTA3ODA3MjU2IiBpbnN0YWxsX3RpbWVfbXM9IjcwNTg4Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:7336

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Enumerates system info in registry
PID:5976
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdcd6df9f0,0x7ffdcd6dfa00,0x7ffdcd6dfa10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5964
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=2056 --field-trial-handle=2068,i,1289511701730450575,9766970188145865019,262144 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:1408
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2032 --field-trial-handle=2068,i,1289511701730450575,9766970188145865019,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2480

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3584
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdcd6df9f0,0x7ffdcd6dfa00,0x7ffdcd6dfa10
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:6012
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:2
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3936
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2020 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3628
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2500 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:232
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3132 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5272
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4408
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3336 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4528
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3976 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4348
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4440 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4664
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5016 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5164
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3140 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4176
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3280 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4872
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5416 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:5364
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5576 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  PID:3680
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3240 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4928
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5840 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5520
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4960 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2840
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6152 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:448
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4952 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1976
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6868 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6352
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4904 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:10008
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6276 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6264
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6256 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6292
- C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  PID:6284
- - C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0x270,0x274,0x278,0x24c,0x27c,0x7ff66625a9f8,0x7ff66625aa08,0x7ff66625aa18
    3⤵
    - Executes dropped EXE
    PID:6908
- - C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe
    "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\master_preferences" --create-shortcuts=1 --install-level=0
    3⤵
    - Executes dropped EXE
    - Suspicious use of FindShellTrayWindow
    PID:8052
  - - C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe
      "C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.122\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.122 --initial-client-data=0x264,0x268,0x26c,0x240,0x270,0x7ff66625a9f8,0x7ff66625aa08,0x7ff66625aa18
      4⤵
      Executes dropped EXE
      PID:6964
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5456 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:6184
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6344 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3728
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6176 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7132
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6884 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:4044
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6636 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:3752
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6876 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:2616
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6148 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7164
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6880 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:7428
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4316 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:9136
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5152 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:10124
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4896 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:9492
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4284 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:9664
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4156 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Executes dropped EXE
  PID:9884
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --start-stack-profiler --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAkAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=6784 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4200
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6344 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  PID:6316
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --start-stack-profiler --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=40 --mojo-platform-channel-handle=6184 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5632
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=1977730288831237657 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=41 --mojo-platform-channel-handle=6960 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:5240
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6812 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:8312
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5932 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  PID:8488
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=file_util --mojo-platform-channel-handle=5832 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  PID:8516
- C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
  "C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6572 --field-trial-handle=1960,i,3940320913132215011,5775645350161595744,262144 /prefetch:8
  2⤵
  PID:9220

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3bc 0x3c4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /c
1⤵
PID:7040
- C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /cr
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6768
- C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler.exe
  "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler.exe"
  2⤵
  PID:6772
- C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler64.exe
  "C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler64.exe"
  2⤵
  PID:872
- C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
  "C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource core
  2⤵
  PID:7092

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ua /installsource scheduler
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:7044

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3844

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\" -an -ai#7zMap3847:86:7zEvent26549
1⤵
- Suspicious use of FindShellTrayWindow
PID:8916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5604

C:\Users\Admin\Desktop\ps3 controller\ScpServer\bin\ScpDriver.exe
"C:\Users\Admin\Desktop\ps3 controller\ScpServer\bin\ScpDriver.exe"
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5524

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:8
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{bdd0db97-cd65-2b49-8aff-2ff1ed0eeb81}\ScpVBus.inf" "9" "44474a297" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "C:\Users\Admin\Desktop\ps3 controller\ScpServer\bin\System"
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  - Modifies data under HKEY_USERS
  PID:1984
- - C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Windows\system32\pnpui.dll,InstallSecurityPromptRunDllW 20 Global\{51f165db-14e4-e34b-8b9d-971fee145650} Global\{e17ca257-43e4-f242-a41f-f7130482db16} C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\ScpVBus.inf C:\Windows\System32\DriverStore\Temp\{7b7a72a7-e2ba-6c46-ade3-d751de7a7b9f}\ScpVBus.cat
    3⤵
    PID:6580
- C:\Windows\system32\DrvInst.exe
  DrvInst.exe "2" "211" "ROOT\SYSTEM\0001" "C:\Windows\INF\oem3.inf" "oem3.inf:174edf1987555a35:ScpVBus_Install:1.0.0.103:root\scpvbus," "4b5cfab93" "000000000000014C"
  2⤵
  - Drops file in Drivers directory
  - Drops file in Windows directory
  - Checks SCSI registry key(s)
  PID:7888

C:\Users\Admin\Desktop\ps3 controller\ScpServer\bin\ScpService.exe
"C:\Users\Admin\Desktop\ps3 controller\ScpServer\bin\ScpService.exe"
1⤵
PID:6320

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery