snakebot | hxxps://www[.]mediafire[.]com/file/hr6ak5frkp66l0i/5M_db_mix[.]txt/file

Modify Registry

Processes:

setup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\StubPath = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.126\\Installer\\chrmstp.exe\" --configure-user-settings --verbose-logging --system-level"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Localized Name = "Brave"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\IsInstalled = "1"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\Version = "43,0,0,0"	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components	setup.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{AFE6A462-C574-4B8A-AF43-4CC60DF4563B}\ = "Brave"	setup.exe

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

BraveUpdate.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe	BraveUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BraveUpdate.exe\DisableExceptionChainValidation = "0"	BraveUpdate.exe

Checks computer location settings 2 TTPs 10 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

brave.exeBraveUpdate.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	BraveUpdate.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation	brave.exe

Executes dropped EXE 57 IoCs

Processes:

BraveBrowserSetup-BRV010.exeBraveUpdate.exeBraveUpdate.exeBraveUpdate.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exeBraveUpdate.exeBraveUpdate.exeBraveUpdate.exebrave_installer-x64.exesetup.exesetup.exebrave_vpn_helper.exesetup.exesetup.exebrave_vpn_helper.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exechrmstp.exechrmstp.exechrmstp.exechrmstp.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exeBraveCrashHandler.exeBraveCrashHandler64.exeBraveUpdate.exebrave.exebrave.exebrave.exebrave.exebrave.exe

pid	process
1844	BraveBrowserSetup-BRV010.exe
4764	BraveUpdate.exe
1016	BraveUpdate.exe
2052	BraveUpdate.exe
4724	BraveUpdateComRegisterShell64.exe
400	BraveUpdateComRegisterShell64.exe
1404	BraveUpdateComRegisterShell64.exe
3612	BraveUpdate.exe
4700	BraveUpdate.exe
1612	BraveUpdate.exe
3500	brave_installer-x64.exe
1972	setup.exe
4980	setup.exe
404	brave_vpn_helper.exe
3560	setup.exe
2288	setup.exe
5092	brave_vpn_helper.exe
5320	brave.exe
5348	brave.exe
5520	brave.exe
5584	brave.exe
5600	brave.exe
5832	brave.exe
5944	brave.exe
5220	brave.exe
1512	brave.exe
6116	brave.exe
6008	brave.exe
6256	brave.exe
6272	brave.exe
6744	brave.exe
6844	brave.exe
6968	brave.exe
7108	brave.exe
9684	brave.exe
9780	brave.exe
9848	brave.exe
9652	chrmstp.exe
21500	chrmstp.exe
6884	chrmstp.exe
6296	chrmstp.exe
9764	brave.exe
18524	brave.exe
9156	brave.exe
9020	brave.exe
8816	brave.exe
7828	brave.exe
6648	brave.exe
10532	brave.exe
10600	BraveCrashHandler.exe
10612	BraveCrashHandler64.exe
10684	BraveUpdate.exe
10856	brave.exe
11100	brave.exe
11460	brave.exe
9716	brave.exe
12644	brave.exe

Loads dropped DLL 64 IoCs

Processes:

BraveUpdate.exeBraveUpdate.exeBraveUpdate.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exeBraveUpdate.exeBraveUpdate.exeBraveUpdate.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exebrave.exe

pid	process
4764	BraveUpdate.exe
1016	BraveUpdate.exe
2052	BraveUpdate.exe
4724	BraveUpdateComRegisterShell64.exe
2052	BraveUpdate.exe
400	BraveUpdateComRegisterShell64.exe
2052	BraveUpdate.exe
1404	BraveUpdateComRegisterShell64.exe
2052	BraveUpdate.exe
3612	BraveUpdate.exe
4700	BraveUpdate.exe
1612	BraveUpdate.exe
1612	BraveUpdate.exe
4700	BraveUpdate.exe
5320	brave.exe
5348	brave.exe
5320	brave.exe
5520	brave.exe
5520	brave.exe
5584	brave.exe
5520	brave.exe
5520	brave.exe
5520	brave.exe
5520	brave.exe
5520	brave.exe
5600	brave.exe
5584	brave.exe
5600	brave.exe
5944	brave.exe
5944	brave.exe
5832	brave.exe
5220	brave.exe
5220	brave.exe
1512	brave.exe
1512	brave.exe
5832	brave.exe
6116	brave.exe
6116	brave.exe
6008	brave.exe
6008	brave.exe
6256	brave.exe
6256	brave.exe
6272	brave.exe
6272	brave.exe
6744	brave.exe
6744	brave.exe
6844	brave.exe
6844	brave.exe
6968	brave.exe
6968	brave.exe
7108	brave.exe
7108	brave.exe
9684	brave.exe
9684	brave.exe
9780	brave.exe
9780	brave.exe
9848	brave.exe
9848	brave.exe
18524	brave.exe
18524	brave.exe
9156	brave.exe
9156	brave.exe
9020	brave.exe
9020	brave.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Registers COM server for autorun 1 TTPs 34 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

BraveUpdateComRegisterShell64.exesetup.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ServerExecutable = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.126\\notification_helper.exe"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32\ = "\"C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\114.1.52.126\\notification_helper.exe\""	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{06C9646D-2807-44C0-97D2-6DA0DB623DB4}\LocalServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 64 IoCs

Processes:

brave.exeBraveUpdate.exesetup.exeBraveBrowserSetup-BRV010.exechrmstp.exe

description	ioc	process
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\51tMb3zBKDiQhNwGqpgwbavaGH54mk8fXFzxTc1xnasg.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\Gamma.png	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_it.dll	BraveUpdate.exe
File created	C:\Program Files\chrome_url_fetcher_5320_853686540\extension_1_0_10.crx	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\GzpRsvnKXKz586kRLkjdppR4dUCFwHa2qaszKkPUQx6g.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\SENBBKVCM7homnf5RX9zqpf1GFe935hnbU4uVzY1Y6M.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\sYFL.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\dehive.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\4dydh8EGNEdTz6grqnGBxpduRg55eLnwNZXoNZJetadu.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\83LGLCm7QKpYZbX8q4W2kYWbtt8NJBwbVwEepzkVnJ9y.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\IAM.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\B6aJ3TGfme3SMnLSouHXqWXjVFqYyqj7czzhzr8WJFAi.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\6VNKqgz9hk7zRShTFdg5AnkfKwZUcojzwAkzxSH3bnUm.png	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_sr.dll	BraveUpdate.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\gala.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\uni.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\twitter\_locales\ko\messages.json	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_fr.dll	BraveUpdate.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\Locales\es.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\resources\brave_extension\_locales\sv\messages.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\twitter\_locales\uk\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\github\_locales\ko\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\Es9vMFrzaCERmJfrF4H2FYD4KCoNkY11McCe8BenwNYB.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\reddit\_locales\id\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\bobsrepair.png	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\resources\brave_extension\_locales\en_GB\messages.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1470106986\list.txt	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\o1Mw5Y3n68o8TakZFuGKLZMGjm72qv4JeoZvGiCLEvK.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\Taki7fi3Zicv7Du1xNAWLaf6mRK7ikdn77HeGzgwvo4.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\CH74tuRLTYcxG7qNJCsV9rghfLXJCQJbsu7i52a8F1Gn.png	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\Locales\sv.pak	setup.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\MEIPreload\manifest.json	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\plotx.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\chronobank.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\3jzdrXXKxwkBk82u2eCWASZLCKoZs1LQTg87HBEAmBJw.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\reddit\_locales\hu\messages.json	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\aKNC.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\H5gczCNbrtso6BqGKihF97RaWaxpUEZnFuFUKK4YX3s2.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ic_token_ilink.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ISH.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\CRBN.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\9zoqdwEBKWEi9G5Ze8BSkdmppxGgVv1Kw4LuigDiNr9m.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\6VYF5jXq6rfq4QRgGMG6co7b1Ev1Lj7KSbHBxfQ9e1L3.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_648941455\1\scripts\brave_rewards\publisher\twitter\_locales\en_GB\messages.json	brave.exe
File created	C:\Program Files\BraveSoftware\Brave-Browser\Temp\source1972_830113300\Chrome-bin\114.1.52.126\Locales\lt.pak	setup.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\sora-xstusd.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\BRLsMczKuaR5w9vSubF4j8HwEGGprVAyyVgS4EX7DKEg.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_2023616164\manifest.fingerprint	brave.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\goopdateres_id.dll	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\goopdateres_uk.dll	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ic_token_ibtc.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\bacon.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\gear.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ic_token_ieth.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\buMnhMd5xSyXBssTQo15jouu8VhuEZJCfbtBUZgRcuW.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1353787755\6.0\httpse.leveldb.zip	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ISKe.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\rdai.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\parsiq.png	brave.exe
File opened for modification	C:\Program Files\Crashpad\settings.dat	chrmstp.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\goopdateres_pl.dll	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\goopdateres_sw.dll	BraveUpdate.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\APE.png	brave.exe
File created	C:\Program Files\chrome_ComponentUnpacker_BeginUnzipping5320_1432181923\images\ALKiRVrfLgzeAV2mCT7cJHKg3ZoPvsCRSV7VCRWnE8zQ.png	brave.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

brave.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	brave.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	brave.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	brave.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = d93b5b04e245d901	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 64 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4216340713"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "769"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393889579"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{268C9F3F-0E21-11EE-8227-CA267358E1AC} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "124"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\Total	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "111"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\NumberOfSubdomains = "1"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\RepId\PublicId = "{1CC1CB33-8042-40DB-BF0F-D212EFBB2BE5}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31040045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "769"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\mediafire.com	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "0"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31040045"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d046a4fd2da2d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\mediafire.com\Total = "769"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4216496688"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "124"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com\ = "111"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\DOMStorage\www.mediafire.com	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "51"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4223059263"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a686b5cdb770847ae5eddbfb090edea000000000200000000001066000000010000200000004cf3d9466f16b3afc72033f98a3a45d5c548a6c0ad5f0dd23a9e1dd9cff23b88000000000e80000000020000200000000a4cfd080a02ea70620165062e1279f27ecb35a043b30299bec1c17b8782a36a20000000ad3e31d6dc4d86c98b2335c80677c54fdc1fab2eedb64cf684916996e38d51a740000000315ebeb4abd5d224556747b3f87275bab6b02fba2882c3280d9a265d60d8325ecc157ba58d2b24af9050e1c3cb4e983ccdbfe30b64e1c5cff859611d21caa4eb	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = f07d93fd2da2d901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DOMStorage\Total\ = "111"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000003a686b5cdb770847ae5eddbfb090edea000000000200000000001066000000010000200000005b4aeb06144698863c1cd57b1ea3439d9f2ebd5ef8b45c0a92894314b19deb1c000000000e80000000020000200000001c3ce55e99ff31d79463a8c82fcbd099a8ba36de09bf6fb1d95616d0fbbc72cd20000000e2c420b685c9c0dfc0bbcec46ac5ca57d1420edab1bece7668b8a76cd345400f4000000007ba356f5fb690922e05c20ab75e7af37eb68a5c0dd9793199688d84646eb4244db482e1f07d2ab81af247fad2a47e48f4425ee448874d1c623952d209ca2f4e	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31040045"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

brave.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	brave.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133315987179723384"	brave.exe

Modifies registry class 64 IoCs

Processes:

BraveUpdate.exeBraveUpdate.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exeBraveUpdateComRegisterShell64.exesetup.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreClass.1\CLSID\ = "{3AD2D487-D166-4160-8E36-1AE505233A55}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7A24060E-533F-4962-9E15-34BD82555FA7}\ProxyStubClsid32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ = "IProcessLauncher2"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A4BCDF52-2179-4C77-8C5F-B8095712B563}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\NumMethods\ = "9"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\ProgID	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods\ = "13"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveFile\AppUserModelId = "Brave"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}\InprocServer32\ThreadingModel = "Both"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CredentialDialogMachine.1.0	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ = "C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\psmachine_64.dll"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{F234546B-DACD-4374-97CF-7BADFAB76766}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{70E5ECF5-2CA7-4019-9B23-916789A13C2C}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoCreateAsync\CurVer	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\NumMethods\ = "13"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{4C929BFE-4FA4-488D-B1E2-82ECD6F076C8}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreMachineClass\CurVer	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebMachineFallback\CurVer	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66CE3D6C-0B35-4F78-AC77-39728A75CB75}\ProgID	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassSvc\CLSID	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.CoreClass\CurVer	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10479D64-2C5F-46CD-9BC8-FD04FF4D02D8}\ProxyStubClsid32	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D5627FC9-E2F0-484B-89A4-5DACFE7FAAD3}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F7FF255A-A593-41BD-A69B-E05D72B72756}\Elevation	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AAE4AD28-500D-43BA-9F54-730CA146C190}\NumMethods	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.OnDemandCOMClassMachine.1.0	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.PolicyStatusMachine\CurVer	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveHTML\Application\ApplicationIcon = "C:\\Program Files\\BraveSoftware\\Brave-Browser\\Application\\brave.exe,0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7CB305B1-4D45-4668-AD91-677F87BED305}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{19F4616B-B7DD-4B3F-8084-C81C5C77AAA4}\ = "IAppCommandWeb"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A147722A-5568-4B84-B401-86D744470CBF}\NumMethods\ = "43"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1985533F-9B0F-490A-85C5-24F316E66FB2}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\BraveSoftwareUpdate.Update3WebSvc\CLSID	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3A9D7221-2278-41DD-930B-C2356B7D3725}\ProgID\ = "BraveSoftwareUpdate.Update3WebSvc.1.0"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{8504FB26-FC3E-4C1C-9C94-46EC93E6BA63}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD84E356-3D21-44C8-83DD-6BEEC22FA427}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{10DB7BD5-BD0B-4886-9705-174203FE0ADA}\ = "IPolicyStatus"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{931E73FD-D487-4458-AA08-1FF41413377B}\NumMethods\ = "12"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}\ProxyStubClsid32	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EBDA5D88-AA7D-4A8C-A20C-C01FADB43EDA}\InprocServer32	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{98E098F3-B390-4575-A5E1-C037BAD4C189}\InprocHandler32	BraveUpdateComRegisterShell64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}\InProcServer32\ThreadingModel = "Both"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7CFC4E00-1C9D-443D-B5BE-CEEEAC1443AF}	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\ = "Google Update Legacy On Demand"	BraveUpdate.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3282EB12-D954-4FD2-A2E1-C942C8745C65}\Elevation\Enabled = "1"	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{FB43AAD0-DDBA-4D01-A3E0-FAB100E7926B}\ = "IAppWeb"	BraveUpdateComRegisterShell64.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC03C0E4-1528-4299-89B2-419644FA48AC}	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EFF9CA12-4CD3-474B-B881-CDE1D92F1996}\NumMethods\ = "23"	BraveUpdate.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\NumMethods	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{28C83F57-E4C0-4B54-B187-585C51EE8F9C}\LocalServer32\ = "\"C:\\Program Files (x86)\\BraveSoftware\\Update\\1.3.361.137\\BraveUpdateBroker.exe\""	BraveUpdate.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{660130E8-74E4-4821-A6FD-4E9A86E06470}\ProxyStubClsid32\ = "{F23FB311-DCFB-469A-98BA-633CB3AAF1C2}"	BraveUpdateComRegisterShell64.exe

NTFS ADS 4 IoCs

Processes:

firefox.exeBraveBrowserSetup-BRV010.exeBraveUpdate.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Animoto.com [+5kk new records].txt:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe:Zone.Identifier	firefox.exe
File created	C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\BraveUpdateSetup.exe\:Zone.Identifier:$DATA	BraveBrowserSetup-BRV010.exe
File created	C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateSetup.exe\:Zone.Identifier:$DATA	BraveUpdate.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

5032 NOTEPAD.EXE

pid	process
5032	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 17 IoCs

Processes:

BraveUpdate.exebrave.exeBraveUpdate.exeBraveUpdate.exe

pid	process
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
4764	BraveUpdate.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
4700	BraveUpdate.exe
4700	BraveUpdate.exe
4700	BraveUpdate.exe
4700	BraveUpdate.exe
10684	BraveUpdate.exe
10684	BraveUpdate.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

Processes:

brave.exe

pid process

5320 brave.exe
5320 brave.exe
5320 brave.exe
5320 brave.exe
5320 brave.exe
5320 brave.exe
5320 brave.exe
5320 brave.exe

pid	process
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exeBraveUpdate.exebrave_installer-x64.exesetup.exesetup.exebrave.exe

description	pid	process
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	1904	firefox.exe
Token: SeDebugPrivilege	4764	BraveUpdate.exe
Token: SeDebugPrivilege	4764	BraveUpdate.exe
Token: SeDebugPrivilege	4764	BraveUpdate.exe
Token: SeDebugPrivilege	4764	BraveUpdate.exe
Token: 33	3500	brave_installer-x64.exe
Token: SeIncBasePriorityPrivilege	3500	brave_installer-x64.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	3560	setup.exe
Token: SeDebugPrivilege	1972	setup.exe
Token: SeDebugPrivilege	1972	setup.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe
Token: SeCreatePagefilePrivilege	5320	brave.exe
Token: SeShutdownPrivilege	5320	brave.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

iexplore.exefirefox.exesetup.exebrave.exechrmstp.exe

pid	process
4152	iexplore.exe
4152	iexplore.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
3560	setup.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
6884	chrmstp.exe

Suspicious use of SendNotifyMessage 15 IoCs

Processes:

firefox.exebrave.exe

pid	process
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe
5320	brave.exe

Suspicious use of SetWindowsHookEx 27 IoCs

Processes:

iexplore.exeIEXPLORE.EXEfirefox.exe

pid	process
4152	iexplore.exe
4152	iexplore.exe
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
2216	IEXPLORE.EXE
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe
1904	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

iexplore.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4152 wrote to memory of 2216	4152	iexplore.exe	IEXPLORE.EXE
PID 4152 wrote to memory of 2216	4152	iexplore.exe	IEXPLORE.EXE
PID 4152 wrote to memory of 2216	4152	iexplore.exe	IEXPLORE.EXE
PID 4152 wrote to memory of 2652	4152	iexplore.exe	NOTEPAD.EXE
PID 4152 wrote to memory of 2652	4152	iexplore.exe	NOTEPAD.EXE
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 2472 wrote to memory of 1904	2472	firefox.exe	firefox.exe
PID 1904 wrote to memory of 4868	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 4868	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe
PID 1904 wrote to memory of 1412	1904	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.mediafire.com/file/hr6ak5frkp66l0i/5M_db_mix.txt/file
1⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4152

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4152 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2216

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\5M db mix.txt
2⤵
PID:2652

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.0.572442664\1458512206" -parentBuildID 20221007134813 -prefsHandle 1852 -prefMapHandle 1844 -prefsLen 20890 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5836c227-994f-4f82-8dde-af1dc87cc0c1} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 1948 25b6ed16b58 gpu
3⤵
PID:4868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.1.738000763\2142265590" -parentBuildID 20221007134813 -prefsHandle 2320 -prefMapHandle 2316 -prefsLen 20926 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1dc3b970-a41a-4ce1-abaa-6f530fbd83fa} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 2332 25b60d71058 socket
3⤵
PID:1412

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.2.220830602\1559430539" -childID 1 -isForBrowser -prefsHandle 3096 -prefMapHandle 2996 -prefsLen 21074 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {39407fbb-81ab-419e-8b64-b6ab72428187} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 3036 25b71a03558 tab
3⤵
PID:2632

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.3.1394099138\1473713043" -childID 2 -isForBrowser -prefsHandle 3528 -prefMapHandle 3292 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {542301ca-d72e-4086-8f57-94d5a71aedf3} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 3556 25b707b2158 tab
3⤵
PID:2812

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.4.13732166\177663262" -childID 3 -isForBrowser -prefsHandle 3976 -prefMapHandle 3972 -prefsLen 26519 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3c863e9-e4f3-48a2-aee4-01164a056edc} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 3984 25b728ab858 tab
3⤵
PID:3432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.5.1014941405\54246413" -childID 4 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {15fa1929-1dcb-477b-a3ca-b14f5cc1c295} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5216 25b746d3258 tab
3⤵
PID:968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.7.1907087723\574063427" -childID 6 -isForBrowser -prefsHandle 5584 -prefMapHandle 5588 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49a18351-285a-46d7-b1fa-2c0ee8f906ed} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5576 25b746d3b58 tab
3⤵
PID:4988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.6.1026746224\1473016698" -childID 5 -isForBrowser -prefsHandle 5184 -prefMapHandle 5196 -prefsLen 26657 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {32385a1f-28f8-48ab-8616-546aff1b9625} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5240 25b746d2058 tab
3⤵
PID:2204

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.8.1765805076\1253205868" -parentBuildID 20221007134813 -prefsHandle 5344 -prefMapHandle 2928 -prefsLen 26939 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ac0bea86-3dc0-422f-b51e-9c967aa0cfe2} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5920 25b73abdf58 rdd
3⤵
PID:5040

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.9.1687909857\1767408314" -childID 7 -isForBrowser -prefsHandle 3460 -prefMapHandle 5628 -prefsLen 26939 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6e4b9a4a-586c-47f3-a0a1-c8cde84c413e} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 3500 25b75b4f658 tab
3⤵
PID:3368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.10.1392948130\438440188" -childID 8 -isForBrowser -prefsHandle 5460 -prefMapHandle 5600 -prefsLen 26939 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bc1d9e91-fc16-4e76-b392-ff4a048824bd} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5552 25b746d3858 tab
3⤵
PID:1356

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.11.1969994879\389476406" -childID 9 -isForBrowser -prefsHandle 5380 -prefMapHandle 5804 -prefsLen 26939 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb4e089-d4db-45b8-8878-4683c3df57b0} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6260 25b75f07c58 tab
3⤵
PID:528

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.12.2097983752\1779286485" -childID 10 -isForBrowser -prefsHandle 6168 -prefMapHandle 5056 -prefsLen 27114 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b12a3d5c-cca1-4c5a-9381-78591cd00a8d} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6180 25b7088a758 tab
3⤵
PID:508

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.13.1290848675\1916808547" -childID 11 -isForBrowser -prefsHandle 6096 -prefMapHandle 6808 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a1c1e35-c2ed-4eca-8130-a44038b88607} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5244 25b708e0658 tab
3⤵
PID:2696

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.14.1800603158\1717950275" -childID 12 -isForBrowser -prefsHandle 5528 -prefMapHandle 3504 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daaa52a9-3da2-40b4-8c97-50b57a0373c0} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5472 25b7aa47558 tab
3⤵
PID:3796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.15.216381847\1634183464" -childID 13 -isForBrowser -prefsHandle 5332 -prefMapHandle 5436 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4ffa120a-68db-423c-8536-8343f8f6d9da} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6472 25b7aa48d58 tab
3⤵
PID:2772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.16.122791551\698060408" -childID 14 -isForBrowser -prefsHandle 6632 -prefMapHandle 6640 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2cd2b68f-1007-4c11-ab4b-d5c631e50b98} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6272 25b70824858 tab
3⤵
PID:796

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.17.1327256571\1284243194" -childID 15 -isForBrowser -prefsHandle 7444 -prefMapHandle 5400 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c21f61d3-1a3e-475a-8915-d4e280c37dca} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 7404 25b7c80f258 tab
3⤵
PID:2792

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.18.755147958\637071061" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 10520 -prefMapHandle 10612 -prefsLen 30336 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1cecb42-9853-4f4b-b691-36e93eb54478} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 10516 25b75f78a58 utility
3⤵
PID:3008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.21.1952307819\1003367016" -childID 18 -isForBrowser -prefsHandle 9888 -prefMapHandle 9884 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c32ceca-af27-464b-9229-f097acbc4180} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 9896 25b7788a558 tab
3⤵
PID:4828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.20.730586067\1164811725" -childID 17 -isForBrowser -prefsHandle 10012 -prefMapHandle 10016 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb4aae64-902c-4980-ba5e-88eeb515927a} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 10004 25b7788ae58 tab
3⤵
PID:2808

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.19.1305405163\1554662942" -childID 16 -isForBrowser -prefsHandle 10260 -prefMapHandle 10264 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e6430b3-5dcc-44d6-8aa1-62e160536fbe} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 10276 25b70889258 tab
3⤵
PID:968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.22.747019639\936783540" -childID 19 -isForBrowser -prefsHandle 10720 -prefMapHandle 10708 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7d6b4179-bc62-41cf-aa65-6f9778e5971c} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 7396 25b77ae3758 tab
3⤵
PID:4068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.23.717268146\2118729033" -childID 20 -isForBrowser -prefsHandle 6420 -prefMapHandle 6924 -prefsLen 30336 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {41ea7f68-f3e6-4689-8d90-ee3dd58b8948} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6912 25b70889258 tab
3⤵
PID:512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.24.167109186\619079623" -childID 21 -isForBrowser -prefsHandle 9960 -prefMapHandle 9944 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4515eb4-f0cc-4dd4-9f32-e83b7b3e038f} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 9972 25b73abca58 tab
3⤵
PID:1840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.25.1229225487\1050451228" -childID 22 -isForBrowser -prefsHandle 2932 -prefMapHandle 3252 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {97ba8d9e-44e0-49e6-b03b-a2b0f435163d} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 4764 25b73abbe58 tab
3⤵
PID:4900

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.26.475392925\673913328" -childID 23 -isForBrowser -prefsHandle 3644 -prefMapHandle 10328 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba947e3f-113c-4845-baee-b46785a9ea9e} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 10020 25b708e1858 tab
3⤵
PID:3800

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.27.156818011\1314332249" -childID 24 -isForBrowser -prefsHandle 9744 -prefMapHandle 9748 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9831b763-bf0c-4507-92cb-6fa7021a0c7a} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 9756 25b75b4f058 tab
3⤵
PID:2912

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.28.465797031\1785541046" -childID 25 -isForBrowser -prefsHandle 5084 -prefMapHandle 4560 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {880bb716-9a43-40af-aaa9-d11ddc0fd8ed} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 9912 25b75b4e158 tab
3⤵
PID:1276

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.29.1685356847\192021258" -childID 26 -isForBrowser -prefsHandle 9996 -prefMapHandle 3588 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {917ddb2c-6dac-43e0-974f-e6582dabaf4e} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6536 25b762f1658 tab
3⤵
PID:744

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.30.1389196070\601150257" -childID 27 -isForBrowser -prefsHandle 6676 -prefMapHandle 6672 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {547dd635-2342-4c4d-aeb3-8955f180cc73} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5320 25b73da9258 tab
3⤵
PID:1848

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.31.181592744\1167950198" -childID 28 -isForBrowser -prefsHandle 1680 -prefMapHandle 6708 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c3c526c7-ad0b-4d8d-82cd-afb4839ea73a} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 10528 25b7c810458 tab
3⤵
PID:4056

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.32.1701031075\621439321" -childID 29 -isForBrowser -prefsHandle 6792 -prefMapHandle 10592 -prefsLen 30345 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {67598c48-e9f1-437f-96a9-e168ab73578c} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6400 25b73f57058 tab
3⤵
PID:3560

C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe
"C:\Users\Admin\Downloads\BraveBrowserSetup-BRV010.exe"
3⤵
- Executes dropped EXE
- Drops file in Program Files directory
- NTFS ADS
PID:1844

C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Temp\GUM67B5.tmp\BraveUpdate.exe" /installsource taggedmi /install "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none"
4⤵
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4764

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regsvc
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:1016

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /regserver
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies registry class
PID:2052

C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:4724

C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:400

C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe
"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveUpdateComRegisterShell64.exe"
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:1404

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4NzhGM0NGRS00RERDLTRGMkItOERGQi0zNzFEMDkzNjc4MzV9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7MDJFOTk0QzEtQjk4OC00OTIwLTlFQUItN0M5QTkxMTNCMDI3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntCMTMxQzkzNS05QkU2LTQxREEtOTU5OS0xRjc3NkJFQjgwMTl9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxLjMuMzYxLjEzNyIgbGFuZz0iIiBicmFuZD0iIiBjbGllbnQ9IiI-PGV2ZW50IGV2ZW50dHlwZT0iMiIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIgaW5zdGFsbF90aW1lX21zPSIxMDgwIi8-PC9hcHA-PC9yZXF1ZXN0Pg
5⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3612

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /handoff "appguid={AFE6A462-C574-4B8A-AF43-4CC60DF4563B}&appname=Brave-Release&needsadmin=prefers&ap=x64-rel&referral=none" /installsource taggedmi /sessionid "{878F3CFE-4DDC-4F2B-8DFB-371D09367835}"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:4700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.33.1086828615\208178920" -childID 30 -isForBrowser -prefsHandle 1720 -prefMapHandle 3768 -prefsLen 30354 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72e50b64-1afa-4b29-a1da-7a8484972bce} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5416 25b70824e58 tab
3⤵
PID:4448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.34.857447980\215123116" -childID 31 -isForBrowser -prefsHandle 6116 -prefMapHandle 2884 -prefsLen 30354 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dfeed847-baa7-42a7-84e0-11f14bc27b0a} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 5500 25b70826c58 tab
3⤵
PID:4500

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.35.1560630124\2028499822" -childID 32 -isForBrowser -prefsHandle 7440 -prefMapHandle 4376 -prefsLen 30354 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {623e2185-6f7a-4e20-86c0-4edfd0527e9f} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 4816 25b728f3c58 tab
3⤵
PID:4288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1904.36.1169386415\1541499032" -childID 33 -isForBrowser -prefsHandle 1420 -prefMapHandle 6420 -prefsLen 30354 -prefMapSize 232675 -jsInitHandle 1504 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78d4d44-6968-4b30-a8aa-b3a49597c6d4} 1904 "\\.\pipe\gecko-crash-server-pipe.1904" 6416 25b73abc758 tab
3⤵
PID:1020

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\Animoto.com [+5kk new records].txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5032

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /svc
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1612

C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\brave_installer-x64.exe
"C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\brave_installer-x64.exe" --do-not-launch-chrome
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3500

C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe
"C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe" --install-archive="C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\CHROME.PACKED.7Z" --do-not-launch-chrome --brave-referral-code="BRV010"
3⤵
- Modifies Installed Components in the registry
- Executes dropped EXE
- Registers COM server for autorun
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1972

C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe
"C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.126 --initial-client-data=0x268,0x26c,0x270,0x244,0x274,0x7ff782d4a9f8,0x7ff782d4aa08,0x7ff782d4aa18
4⤵
- Executes dropped EXE
PID:4980

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\brave_vpn_helper.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\brave_vpn_helper.exe" --install
4⤵
- Executes dropped EXE
PID:404

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\brave_vpn_helper.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\brave_vpn_helper.exe" --type=crashpad-handler --user-data-dir=C:\ProgramData\BraveSoftware\BraveVpnService /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\ProgramData\BraveSoftware\BraveVpnService\Crashpad --metrics-dir=C:\ProgramData\BraveSoftware\BraveVpnService --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=BraveVpnService --annotation=ver=114.1.52.126 --initial-client-data=0x240,0x244,0x248,0x21c,0x24c,0x7ff76d9a74a8,0x7ff76d9a74b8,0x7ff76d9a74c8
5⤵
- Executes dropped EXE
PID:5092

C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe
"C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe" --system-level --verbose-logging --create-shortcuts=0 --install-level=1
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3560

C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe
"C:\Program Files (x86)\BraveSoftware\Update\Install\{C398B693-F825-41A1-902C-6FD30584A608}\CR_5ED86.tmp\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.126 --initial-client-data=0x264,0x268,0x26c,0x250,0x270,0x7ff782d4a9f8,0x7ff782d4aa08,0x7ff782d4aa18
5⤵
- Executes dropped EXE
PID:2288

C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler64.exe
"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler64.exe"
2⤵
- Executes dropped EXE
PID:10612

C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler.exe
"C:\Program Files (x86)\BraveSoftware\Update\1.3.361.137\BraveCrashHandler.exe"
2⤵
- Executes dropped EXE
PID:10600

C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe
"C:\Program Files (x86)\BraveSoftware\Update\BraveUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4zNjEuMTM3IiBzaGVsbF92ZXJzaW9uPSIxLjMuMzYxLjEzNyIgaXNtYWNoaW5lPSIxIiBzZXNzaW9uaWQ9Ins4NzhGM0NGRS00RERDLTRGMkItOERGQi0zNzFEMDkzNjc4MzV9IiB1c2VyaWQ9InsxRjFCMkUzQi03MzE4LTRGOTMtODI3QS00RkY0N0I0MzM5QTR9IiBpbnN0YWxsc291cmNlPSJ0YWdnZWRtaSIgdGVzdHNvdXJjZT0iYXV0byIgcmVxdWVzdGlkPSJ7NDJBMjE3OTMtQkM1NC00QUFDLUJBNTQtMTA5ODM2NEU4QUU1fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBwaHlzbWVtb3J5PSI4IiBzc2U9IjEiIHNzZTI9IjEiIHNzZTM9IjEiIHNzc2UzPSIxIiBzc2U0MT0iMSIgc3NlNDI9IjEiIGF2eD0iMSIvPjxvcyBwbGF0Zm9ybT0id2luIiB2ZXJzaW9uPSIxMC4wLjE5MDQxLjEyODgiIHNwPSIiIGFyY2g9Ing2NCIvPjxhcHAgYXBwaWQ9IntBRkU2QTQ2Mi1DNTc0LTRCOEEtQUY0My00Q0M2MERGNDU2M0J9IiB2ZXJzaW9uPSIiIG5leHR2ZXJzaW9uPSIxMTQuMS41Mi4xMjYiIGFwPSJ4NjQtcmVsIiBsYW5nPSIiIGJyYW5kPSIiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSItMSIgaW5zdGFsbGRhdGU9Ii0xIj48ZXZlbnQgZXZlbnR0eXBlPSI5IiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIwIi8-PGV2ZW50IGV2ZW50dHlwZT0iNSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjEiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiIGRvd25sb2FkZXI9ImJpdHMiIHVybD0iaHR0cHM6Ly91cGRhdGVzLWNkbi5icmF2ZXNvZnR3YXJlLmNvbS9idWlsZC9CcmF2ZS1SZWxlYXNlL3g2NC1yZWwvd2luLzExNC4xLjUyLjEyNi9icmF2ZV9pbnN0YWxsZXIteDY0LmV4ZSIgZG93bmxvYWRlZD0iMTA3OTE0MjY0IiB0b3RhbD0iMTA3OTE0MjY0IiBkb3dubG9hZF90aW1lX21zPSI5MDAxIi8-PGV2ZW50IGV2ZW50dHlwZT0iMSIgZXZlbnRyZXN1bHQ9IjEiIGVycm9yY29kZT0iMCIgZXh0cmFjb2RlMT0iMCIvPjxldmVudCBldmVudHR5cGU9IjYiIGV2ZW50cmVzdWx0PSIxIiBlcnJvcmNvZGU9IjAiIGV4dHJhY29kZTE9IjAiLz48ZXZlbnQgZXZlbnR0eXBlPSIyIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIxOTY3MDciIHNvdXJjZV91cmxfaW5kZXg9IjAiIHVwZGF0ZV9jaGVja190aW1lX21zPSIzMjQiIGRvd25sb2FkX3RpbWVfbXM9IjEwNzcwIiBkb3dubG9hZGVkPSIxMDc5MTQyNjQiIHRvdGFsPSIxMDc5MTQyNjQiIGluc3RhbGxfdGltZV9tcz0iNDc4MjQiLz48L2FwcD48L3JlcXVlc3Q-
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:10684

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5320

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\BraveSoftware\Brave-Browser\User Data\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.126 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff81317f9f0,0x7ff81317fa00,0x7ff81317fa10
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5348

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=gpu-process --start-stack-profiler --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1952 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:2
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5520

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --start-stack-profiler --mojo-platform-channel-handle=2016 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5584

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2336 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5600

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3180 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5832

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3160 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5944

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=4124 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:5220

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --extension-process --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4276 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
PID:1512

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6116

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6008

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5152 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6256

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6272

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5296 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6744

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5180 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6844

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5224 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6968

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5164 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:7108

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6184 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9684

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6560 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9848

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6420 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9780

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe" --configure-user-settings --verbose-logging --system-level --force-configure-user-settings
2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:9652

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.126 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6877ba9f8,0x7ff6877baa08,0x7ff6877baa18
3⤵
- Executes dropped EXE
PID:21500

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe" --system-level --verbose-logging --installerdata="C:\Program Files\BraveSoftware\Brave-Browser\Application\master_preferences" --create-shortcuts=1 --install-level=0
3⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
PID:6884

C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\114.1.52.126\Installer\chrmstp.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Program Files\Crashpad" --url=https://cr.brave.com --annotation=plat=Win64 --annotation=prod=Brave --annotation=ver=114.1.52.126 --initial-client-data=0x280,0x284,0x288,0x25c,0x28c,0x7ff6877ba9f8,0x7ff6877baa08,0x7ff6877baa18
4⤵
- Executes dropped EXE
PID:6296

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=20 --mojo-platform-channel-handle=6196 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:9764

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6880 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9156

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6040 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:9020

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=6016 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:18524

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:8816

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:7828

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5288 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:6648

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=27 --mojo-platform-channel-handle=4692 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:10532

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=28 --mojo-platform-channel-handle=6392 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:10856

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=renderer --origin-trial-public-key=bYUKPJoPnCxeNvu72j4EmPuK7tr1PAC7SHh8ld9Mw3E=,fMS4mpO6buLQ/QMd+zJmxzty/VQ6B1EUZqoCU04zoRU= --brave_session_token=11049345037240760121 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=29 --mojo-platform-channel-handle=4780 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:1
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:11100

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4228 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:11460

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5792 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:9716

C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe
"C:\Program Files\BraveSoftware\Brave-Browser\Application\brave.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6592 --field-trial-handle=1964,i,7052063351976947855,10311099399993949317,262144 /prefetch:8
2⤵
- Executes dropped EXE
PID:12644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x49c 0x304
1⤵
PID:9904

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery