hxxps://github[.]com/kh4sh3i/Ransomware-Samples/archive/refs/heads/main[.]zip

System Information Discovery

Processes:

qbittorrent.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Control Panel\International\Geo\Nation	qbittorrent.exe

Drops startup file 2 IoCs

Processes:

svchost.exeRansomware.Unnamed_0.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Notepad.lnk	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	Ransomware.Unnamed_0.exe

Executes dropped EXE 4 IoCs

Processes:

Grand Theft Auto 6_k71-y31.exeGrand Theft Auto 6_k71-y31.tmpqbittorrent.exePurblePlace.exe

pid process

4452 Grand Theft Auto 6_k71-y31.exe
5444 Grand Theft Auto 6_k71-y31.tmp
5868 qbittorrent.exe
4164 PurblePlace.exe
Loads dropped DLL 3 IoCs

Processes:

Grand Theft Auto 6_k71-y31.tmp

pid process

5444 Grand Theft Auto 6_k71-y31.tmp
5444 Grand Theft Auto 6_k71-y31.tmp
5444 Grand Theft Auto 6_k71-y31.tmp
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
4452	Grand Theft Auto 6_k71-y31.exe
5444	Grand Theft Auto 6_k71-y31.tmp
5868	qbittorrent.exe
4164	PurblePlace.exe

pid	process
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp

Checks for any installed AV software in registry 1 TTPs 6 IoCs

Security Software Discovery

T1518.001

Processes:

Grand Theft Auto 6_k71-y31.tmp

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\SOFTWARE\AVG\AV\Dir	Grand Theft Auto 6_k71-y31.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast	Grand Theft Auto 6_k71-y31.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast	Grand Theft Auto 6_k71-y31.tmp
Key opened	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\SOFTWARE\AVAST Software\Avast	Grand Theft Auto 6_k71-y31.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV\Dir	Grand Theft Auto 6_k71-y31.tmp
Key opened	\REGISTRY\MACHINE\SOFTWARE\AVG\AV\Dir	Grand Theft Auto 6_k71-y31.tmp

Drops desktop.ini file(s) 2 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\assembly\Desktop.ini svchost.exe
File created C:\Windows\assembly\Desktop.ini svchost.exe
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.

Query Registry
T1012

Peripheral Device Discovery
T1120

System Information Discovery
T1082

Processes:

qbittorrent.exe

description ioc process

File opened (read-only) \??\F: qbittorrent.exe
Program crash 3 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exe

pid pid_target process target process

1520 3688 WerFault.exe mshta.exe
4564 628 WerFault.exe IEXPLORE.EXE
4504 4072 WerFault.exe AcroRd32.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

Ransomware.Unnamed_0.exe

description pid process target process

PID 2400 set thread context of 4820 2400 Ransomware.Unnamed_0.exe vbc.exe

description	ioc	process
File opened for modification	C:\Windows\assembly\Desktop.ini	svchost.exe
File created	C:\Windows\assembly\Desktop.ini	svchost.exe

description	ioc	process
File opened (read-only)	\??\F:	qbittorrent.exe

pid	pid_target	process	target process
1520	3688	WerFault.exe	mshta.exe
4564	628	WerFault.exe	IEXPLORE.EXE
4504	4072	WerFault.exe	AcroRd32.exe

description	pid	process	target process
PID 2400 set thread context of 4820	2400	Ransomware.Unnamed_0.exe	vbc.exe

Drops file in Program Files directory 15 IoCs

Processes:

Purble Place.exe

description	ioc	process
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\en-US\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\PurblePlace.exe.mui	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.BAK	Purble Place.exe
File created	C:\Program Files\Microsoft Games\Purble Place\PurblePlace.cab	Purble Place.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\windowscodeintegrity.luacdf	Purble Place.exe

Drops file in Windows directory 7 IoCs

Processes:

svchost.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
File opened for modification	C:\Windows\assembly	svchost.exe
File created	C:\Windows\assembly\Desktop.ini	svchost.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	svchost.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 17 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

AcroRd32.exefirefox.exefirefox.exeGrand Theft Auto 6_k71-y31.tmpfirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\	Grand Theft Auto 6_k71-y31.tmp
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Grand Theft Auto 6_k71-y31.tmp

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer Phishing Filter 1 TTPs 2 IoCs

Modify Registry

Processes:

iexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\PhishingFilter	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\PhishingFilter\ClientSupported_MigrationTime = f75ab1d31123da01	iexplore.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEbrowser_broker.exeAcroRd32.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\RepId\PublicId = "{332FCC55-B5FE-416B-A8DF-9EB43FAB424E}"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2083491213"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31073486"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\DownloadWindowPlacement = 2c0000000000000000000000ffffffffffffffffffffffffffffffff100100003c000000900300001c020000	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31073486"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{A7C8C00D-90C1-11EE-ABFB-6615F4104317} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\RepId	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2083491213"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31073486"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31073486"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "2083551471"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "2083551471"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe

Modifies data under HKEY_USERS 2 IoCs

Processes:

chrome.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133459605443936849"	chrome.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeqbittorrent.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeOpenWith.exefirefox.exeOpenWith.exeiexplore.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Explorer	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\magnet\shell\open	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\www.fosshub.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListDOSTime = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\fosshub.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\fosshub.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\fosshub.com\NumberOfSubdomai = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath\dummySetting = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Privacy	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\ACGPolicyState = "6"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = ddb539f4ce24da01	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDelete	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\DummyPath	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\magnet\shell\open\command\	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\Total	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\.torrent\ = "qBittorrent"	qbittorrent.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\Active	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\magnet\shell\ = "open"	qbittorrent.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\CIStatus\SignaturePolicy = 06000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{A8A88C49-5EB2-4990-A1A2-08760 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\magnet\shell	qbittorrent.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\DOMStorage\fosshub.com\NumberOfSubdomai = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\ReadingStorePending = "0"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3171942101-2809460380-3727589934-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	MicrosoftEdgeCP.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

qbittorrent.exe

description	ioc	process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 0f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae47420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	qbittorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f20000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	qbittorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 19000000010000001000000068cb42b035ea773e52ef50ecf50ec5290f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f53000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b060105050703080b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df01d0000000100000010000000918ad43a9475f78bb5243de886d8103c7f000000010000000c000000300a06082b060105050703097e000000010000000800000000c001b39667d601030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae474040000000100000010000000acb694a59c17e0d791529bb19706a6e420000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	qbittorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474\Blob = 5c000000010000000400000000080000040000000100000010000000acb694a59c17e0d791529bb19706a6e4030000000100000014000000d4de20d05e66fc53fe1a50882c78db2852cae4747e000000010000000800000000c001b39667d6017f000000010000000c000000300a06082b060105050703091d0000000100000010000000918ad43a9475f78bb5243de886d8103c140000000100000014000000e59d5930824758ccacfa085436867b3ab5044df062000000010000002000000016af57a9f676b0ab126095aa5ebadef22ab31119d644ac95cd4b93dbf3f26aeb0b0000000100000030000000440069006700690043006500720074002000420061006c00740069006d006f0072006500200052006f006f007400000009000000010000003e000000303c06082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030906082b0601050507030106082b0601050507030853000000010000007f000000307d3020060a2b06010401b13e01640130123010060a2b0601040182373c0101030200c0301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f0000000100000014000000ce0e658aa3e847e467a147b3049191093d055e6f19000000010000001000000068cb42b035ea773e52ef50ecf50ec52920000000010000007b030000308203773082025fa0030201020204020000b9300d06092a864886f70d0101050500305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f74301e170d3030303531323138343630305a170d3235303531323233353930305a305a310b300906035504061302494531123010060355040a130942616c74696d6f726531133011060355040b130a43796265725472757374312230200603550403131942616c74696d6f7265204379626572547275737420526f6f7430820122300d06092a864886f70d01010105000382010f003082010a0282010100a304bb22ab983d57e826729ab579d429e2e1e89580b1b0e35b8e2b299a64dfa15dedb009056ddb282ece62a262feb488da12eb38eb219dc0412b01527b8877d31c8fc7bab988b56a09e773e81140a7d1ccca628d2de58f0ba650d2a850c328eaf5ab25878a9a961ca967b83f0cd5f7f952132fc21bd57070f08fc012ca06cb9ae1d9ca337a77d6f8ecb9f16844424813d2c0c2a4ae5e60feb6a605fcb4dd075902d459189863f5a563e0900c7d5db2067af385eaebd403ae5e843e5fff15ed69bcf939367275cf77524df3c9902cb93de5c923533f1f2498215c079929bdc63aece76e863a6b97746333bd681831f0788d76bffc9e8e5d2a86a74d90dc271a390203010001a3453043301d0603551d0e04160414e59d5930824758ccacfa085436867b3ab5044df030120603551d130101ff040830060101ff020103300e0603551d0f0101ff040403020106300d06092a864886f70d01010505000382010100850c5d8ee46f51684205a0ddbb4f27258403bdf764fd2dd730e3a41017ebda2929b6793f76f6191323b8100af958a4d46170bd04616a128a17d50abdc5bc307cd6e90c258d86404feccca37e38c637114feddd68318e4cd2b30174eebe755e07481a7f70ff165c84c07985b805fd7fbe6511a30fc002b4f852373904d5a9317a18bfa02af41299f7a34582e33c5ef59d9eb5c89e7c2ec8a49e4e08144b6dfd706d6b1a63bd64e61fb7cef0f29f2ebb1bb7f250887392c2e2e3168d9a3202ab8e18dde91011ee7e35ab90af3e30947ad0333da7650ff5fc8e9e62cf47442c015dbb1db532d247d2382ed0fe81dc326a1eb5ee3cd5fce7811d19c32442ea6339a9	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A	qbittorrent.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AD7E1C28B064EF8F6003402014C3D0E3370EB58A\Blob = 0f00000001000000140000000f6aad4c3fe04619cdc8b2bd655aa1a26042e6500b000000010000005400000053007400610072006600690065006c006400200043006c00610073007300200032002000430065007200740069006600690063006100740069006f006e00200041007500740068006f007200690074007900000053000000010000004800000030463021060b6086480186fd6d0107170330123010060a2b0601040182373c0101030200c03021060b6086480186fd6e0107170330123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703016200000001000000200000001465fa205397b876faa6f0a9958e5590e40fcc7faa4fb7c2c8677521fb5fb658140000000100000014000000bf5fb7d1cedd1f86f45b55acdcd710c20ea988e71d000000010000001000000090c4f4233b006b7bfaa6adcd8f577d77030000000100000014000000ad7e1c28b064ef8f6003402014c3d0e3370eb58a2000000001000000130400003082040f308202f7a003020102020100300d06092a864886f70d01010505003068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479301e170d3034303632393137333931365a170d3334303632393137333931365a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f7269747930820120300d06092a864886f70d01010105000382010d00308201080282010100b732c8fee971a60485ad0c1164dfce4defc80318873fa1abfb3ca69ff0c3a1dad4d86e2b5390fb24a43e84f09ee85fece52744f528a63f7bdee02af0c8af532f9eca0501931e8f661c39a74dfa5ab673042566eb777fe759c64a99251454eb26c7f37f19d530708fafb0462affadeb29edd79faa0487a3d4f989a5345fdb43918236d9663cb1b8b982fd9c3a3e10c83bef0665667a9b19183dff71513c302e5fbe3d7773b25d066cc323569a2b8526921ca702b3e43f0daf087982b8363dea9cd335b3bc69caf5cc9de8fd648d1780336e5e4a5d99c91e87b49d1ac0d56e1335235edf9b5f3defd6f776c2ea3ebb780d1c42676b04d8f8d6da6f8bf244a001ab020103a381c53081c2301d0603551d0e04160414bf5fb7d1cedd1f86f45b55acdcd710c20ea988e73081920603551d2304818a3081878014bf5fb7d1cedd1f86f45b55acdcd710c20ea988e7a16ca46a3068310b300906035504061302555331253023060355040a131c537461726669656c6420546563686e6f6c6f676965732c20496e632e31323030060355040b1329537461726669656c6420436c61737320322043657274696669636174696f6e20417574686f72697479820100300c0603551d13040530030101ff300d06092a864886f70d01010505000382010100059d3f889dd1c91a55a1ac69f3f359da9b01871a4f57a9a179092adbf72fb21eccc75e6ad88387a197ef49353e7706415862bf8e58b80a673fecb3dd21661fc954fa72cc3d4c40d881af779e837abba2c7f534178ed91140f4fc2c2a4d157fa7625d2e25d3000b201a1d68f917b8f4bd8bed2859dd4d168b1783c8b265c72d7aa5aabc53866ddd57a4caf820410b68f0f4fb74be565d7a79f5f91d85e32d95bef5719043cc8d1f9a000a8729e95522580023eae31243295b4708dd8c416a6506a8e521aa41b4952195b97dd134ab13d6adbcdce23d39cdbd3e7570a1185903c922b48f9cd55e2ad7a5b6d40a6df8b74011469a1f790e62bf0f97ece02f1f1794	qbittorrent.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D4DE20D05E66FC53FE1A50882C78DB2852CAE474	qbittorrent.exe

NTFS ADS 3 IoCs

Processes:

firefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Grand Theft Auto 6_CY-T9S1.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Grand Theft Auto 6_k71-y31.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Grand Theft Auto 6_t-JUck1.exe:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs
ransomware

Processes:

NOTEPAD.EXE

pid process

4108 NOTEPAD.EXE
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 618 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

qbittorrent.exe

pid process

5868 qbittorrent.exe

pid	process
4108	NOTEPAD.EXE

description	flow	ioc
HTTP User-Agent header	618	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

pid	process
5868	qbittorrent.exe

Suspicious behavior: EnumeratesProcesses 61 IoCs

Processes:

chrome.exechrome.exeAcroRd32.exeRansomware.Unnamed_0.exevbc.exeGrand Theft Auto 6_k71-y31.tmp

pid	process
400	chrome.exe
400	chrome.exe
3680	chrome.exe
3680	chrome.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
4072	AcroRd32.exe
2400	Ransomware.Unnamed_0.exe
2400	Ransomware.Unnamed_0.exe
2400	Ransomware.Unnamed_0.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
4820	vbc.exe
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp
5444	Grand Theft Auto 6_k71-y31.tmp

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exeqbittorrent.exe

pid process

4924 OpenWith.exe
664 OpenWith.exe
4928 OpenWith.exe
5868 qbittorrent.exe
Suspicious behavior: MapViewOfSection 4 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

5576 MicrosoftEdgeCP.exe
5576 MicrosoftEdgeCP.exe
5576 MicrosoftEdgeCP.exe
5576 MicrosoftEdgeCP.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

chrome.exe

pid process

400 chrome.exe
400 chrome.exe
400 chrome.exe

pid	process
5576	MicrosoftEdgeCP.exe
5576	MicrosoftEdgeCP.exe
5576	MicrosoftEdgeCP.exe
5576	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe
Token: SeShutdownPrivilege	400	chrome.exe
Token: SeCreatePagefilePrivilege	400	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exeiexplore.exefirefox.exefirefox.exeGrand Theft Auto 6_k71-y31.tmpqbittorrent.exe

pid	process
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
696	iexplore.exe
696	iexplore.exe
4048	firefox.exe
4048	firefox.exe
4048	firefox.exe
4048	firefox.exe
400	chrome.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
5444	Grand Theft Auto 6_k71-y31.tmp
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe

Suspicious use of SendNotifyMessage 54 IoCs

Processes:

chrome.exefirefox.exefirefox.exeqbittorrent.exe

pid	process
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
400	chrome.exe
4048	firefox.exe
4048	firefox.exe
4048	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
3136	firefox.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe
5868	qbittorrent.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

OpenWith.exeOpenWith.exeOpenWith.exeiexplore.exeIEXPLORE.EXEOpenWith.exe

pid	process
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4924	OpenWith.exe
4580	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
664	OpenWith.exe
696	iexplore.exe
696	iexplore.exe
628	IEXPLORE.EXE
628	IEXPLORE.EXE
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe
4928	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 400 wrote to memory of 520	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 520	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 4648	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2216	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 2216	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe
PID 400 wrote to memory of 3528	400	chrome.exe	chrome.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/kh4sh3i/Ransomware-Samples/archive/refs/heads/main.zip
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:400

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffd5ad9758,0x7fffd5ad9768,0x7fffd5ad9778
2⤵
PID:520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1752 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:2216

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:2
2⤵
PID:4648

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:3528

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:1
2⤵
PID:920

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:1
2⤵
PID:4560

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:4772

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5352 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:3760

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:4832

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:8
2⤵
PID:3036

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5080 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=772 --field-trial-handle=1860,i,8608860209624593668,9643578679775152744,131072 /prefetch:1
2⤵
PID:236

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3848

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4924

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Jigsaw.zip\jigsaw
2⤵
- Opens file in notepad (likely ransom note)
PID:4108

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4580

C:\Windows\SysWOW64\mshta.exe
"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Documents\Ransomware.Petrwrap\myguy.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
1⤵
PID:3688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3688 -s 1372
2⤵
- Program crash
PID:1520

C:\Users\Admin\Documents\Ransomware.Petrwrap\svchost.exe
"C:\Users\Admin\Documents\Ransomware.Petrwrap\svchost.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Windows directory
PID:3004

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:664

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cryptowall.zip\cryptowall.bin
2⤵
- Modifies Internet Explorer Phishing Filter
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:696

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:696 CREDAT:82945 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:628

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
4⤵
PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 2220
4⤵
- Program crash
PID:4564

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:4928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Cryptowall.zip\cryptowall.bin"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
PID:4072

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
PID:2688

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CB18E1F81DB4F32932F5DD1A46873E63 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2988

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4FA553744E42CB5E3F94D5FDD3154CA5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4FA553744E42CB5E3F94D5FDD3154CA5 --renderer-client-id=2 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:1
4⤵
PID:1680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2955083A45ABE72248ADD9179EBE4DDF --mojo-platform-channel-handle=2188 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2188

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=04633CB9A17DBD8B552627E9EEA38F19 --mojo-platform-channel-handle=1824 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2044

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=18A89E7FEC0326375966BF3BDFD9A0E6 --mojo-platform-channel-handle=1888 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3088

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
3⤵
PID:3064

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4072 -s 2468
3⤵
- Program crash
PID:4504

C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe
"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.Unnamed_0.zip\Ransomware.Unnamed_0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
PID:2400

C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xjiivvtt\xjiivvtt.cmdline"
2⤵
PID:3688

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF45F.tmp" "c:\Users\Admin\AppData\Local\Temp\xjiivvtt\CSC142C50E6FE704F48B4BE2AF824AF.TMP"
3⤵
PID:2112

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4820

C:\Windows\notepad.exe
"C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
3⤵
PID:2688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4048.0.947035310\502511969" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1696 -prefsLen 20598 -prefMapSize 233275 -appDir "C:\Program Files\Mozilla Firefox\browser" - {715f701f-cae6-47c4-993c-0e8df11bf6ac} 4048 "\\.\pipe\gecko-crash-server-pipe.4048" 1780 1b9c99ce458 gpu
3⤵
PID:3688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4048.1.583290005\154604527" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20679 -prefMapSize 233275 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5faee591-0ff6-4faf-bfa7-b53e5eebfe00} 4048 "\\.\pipe\gecko-crash-server-pipe.4048" 2136 1b9be772e58 socket
3⤵
- Checks processor information in registry
PID:4512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4048.2.1680919123\1703176040" -childID 1 -isForBrowser -prefsHandle 3180 -prefMapHandle 3196 -prefsLen 20782 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cca87cc5-3a4d-4fc2-a4cc-19a1ae8c9a3b} 4048 "\\.\pipe\gecko-crash-server-pipe.4048" 3172 1b9cdb3cd58 tab
3⤵
PID:2468

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4048.3.300144665\1337393412" -childID 2 -isForBrowser -prefsHandle 3640 -prefMapHandle 3636 -prefsLen 25954 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2217e255-8865-4c1e-b45e-7715339da26f} 4048 "\\.\pipe\gecko-crash-server-pipe.4048" 3652 1b9ce10fb58 tab
3⤵
PID:168

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4048.4.1686282429\1695675740" -childID 3 -isForBrowser -prefsHandle 3940 -prefMapHandle 3640 -prefsLen 26013 -prefMapSize 233275 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e1973931-d727-4e7f-a8cf-0486a5131c46} 4048 "\\.\pipe\gecko-crash-server-pipe.4048" 3948 1b9cecd1558 tab
3⤵
PID:1700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:1764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.0.1592860662\458799104" -parentBuildID 20221007134813 -prefsHandle 1676 -prefMapHandle 1668 -prefsLen 20670 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4187a21-d2b4-4f44-b6f8-c0e4f44f4dcc} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 1796 269e7afd958 gpu
3⤵
PID:4700

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.1.1951233409\9251403" -parentBuildID 20221007134813 -prefsHandle 2140 -prefMapHandle 2136 -prefsLen 20751 -prefMapSize 233414 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {66622ca3-406f-4e95-9b6c-da9fcb759ff2} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 2152 269dca6fb58 socket
3⤵
PID:2428

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.2.137724320\1233190342" -childID 1 -isForBrowser -prefsHandle 2904 -prefMapHandle 3020 -prefsLen 20899 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3c50256-7615-46e2-993e-e14bbe4432bb} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 3016 269e7a59558 tab
3⤵
PID:1888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.3.205069265\761938308" -childID 2 -isForBrowser -prefsHandle 3424 -prefMapHandle 3412 -prefsLen 26077 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af11efd2-d3cf-4425-b127-187ae9552627} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 3484 269ea506058 tab
3⤵
PID:1916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.4.2094079447\2036876885" -childID 3 -isForBrowser -prefsHandle 4032 -prefMapHandle 4076 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f0b28f8d-4be3-47fe-828e-967011787ef0} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4088 269ecc7f258 tab
3⤵
PID:1988

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.7.674835288\1087605518" -childID 6 -isForBrowser -prefsHandle 5124 -prefMapHandle 5128 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {59b614b6-5d37-40fd-8e15-f1dae5e55166} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4680 269eddb3258 tab
3⤵
PID:384

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.6.1577157943\1413115448" -childID 5 -isForBrowser -prefsHandle 4928 -prefMapHandle 4932 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0475a107-80b2-4a57-bbb7-3a66f3b24608} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4920 269eddb0b58 tab
3⤵
PID:1868

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.5.1301167042\1675420647" -childID 4 -isForBrowser -prefsHandle 4832 -prefMapHandle 4824 -prefsLen 26136 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8d9b44d8-6faa-4948-b89b-a2b081472a14} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4680 269ec35fb58 tab
3⤵
PID:4564

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.8.145879297\69280918" -childID 7 -isForBrowser -prefsHandle 5608 -prefMapHandle 5604 -prefsLen 26295 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c6a7c51d-2cae-41aa-bad9-09a2fa174f52} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 5620 269ef890858 tab
3⤵
PID:4580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.9.265606030\1203270685" -childID 8 -isForBrowser -prefsHandle 5772 -prefMapHandle 4100 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17be25b7-531d-433c-8cf3-8b1a5de22bca} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 5776 269ead20c58 tab
3⤵
PID:3068

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.10.730760034\1338845037" -parentBuildID 20221007134813 -prefsHandle 2588 -prefMapHandle 2884 -prefsLen 26814 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c7b1cf6-1fed-486f-8a4a-08d88d82f2a3} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4232 269f12cbf58 rdd
3⤵
PID:4392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.11.582738671\673264389" -childID 9 -isForBrowser -prefsHandle 5184 -prefMapHandle 4168 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e5ac5fa-dc06-45e4-947a-a72a99743e97} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 5136 269ecc7e358 tab
3⤵
PID:4444

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.12.1512579788\596900917" -childID 10 -isForBrowser -prefsHandle 9868 -prefMapHandle 9828 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9001ed9-aa6b-4382-80f5-bad780c4f0d9} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9880 269f172d758 tab
3⤵
PID:3852

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.13.1534677113\138866664" -childID 11 -isForBrowser -prefsHandle 9700 -prefMapHandle 9644 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {611a5637-ced8-4e06-b49c-f8e10b8e88ad} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9620 269f18b2b58 tab
3⤵
PID:3028

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.14.805335869\1314736927" -childID 12 -isForBrowser -prefsHandle 9732 -prefMapHandle 9736 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37850c79-8c3d-4009-8081-83756598392d} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9744 269efe10b58 tab
3⤵
PID:3720

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.16.1566242471\2094394012" -childID 14 -isForBrowser -prefsHandle 5268 -prefMapHandle 5212 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4334171e-10bb-47f3-bbf0-385e89950aa4} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9828 269f016ce58 tab
3⤵
PID:820

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.15.203834413\932204297" -childID 13 -isForBrowser -prefsHandle 9676 -prefMapHandle 9804 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2068dca0-a5a4-4058-9d78-587f3e48ec1d} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9680 269efe0ed58 tab
3⤵
PID:1952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.17.1947345192\253014475" -childID 15 -isForBrowser -prefsHandle 9304 -prefMapHandle 5680 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0bab2bac-6070-4b4e-9dfc-7af83dbdacea} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9096 269dca61c58 tab
3⤵
PID:1432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.18.1937902795\1241572597" -childID 16 -isForBrowser -prefsHandle 5728 -prefMapHandle 5736 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f20270a0-9235-49de-bc84-00d6a0521050} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 5132 269ed44b258 tab
3⤵
PID:4752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.19.1402080308\1117138829" -childID 17 -isForBrowser -prefsHandle 9000 -prefMapHandle 8996 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6b7a5128-70e9-4ed3-99c6-6f2286092213} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9008 269ed44c158 tab
3⤵
PID:4776

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.20.400323194\611232936" -childID 18 -isForBrowser -prefsHandle 9480 -prefMapHandle 9444 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {2163ee0c-c2b3-4764-8c06-459039e63d47} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9492 269efe0ed58 tab
3⤵
PID:1952

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.21.1767840356\1548166682" -childID 19 -isForBrowser -prefsHandle 5628 -prefMapHandle 5592 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f73d436-c2e3-4d2b-8569-d7d5cc36938c} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 5772 269ed44be58 tab
3⤵
PID:2044

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.22.1056560850\61021683" -childID 20 -isForBrowser -prefsHandle 5708 -prefMapHandle 9764 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {302f734c-c062-414f-9dbc-73d67b51ef60} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4724 269ed44d958 tab
3⤵
PID:1176

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.23.1388256204\1813537642" -childID 21 -isForBrowser -prefsHandle 8952 -prefMapHandle 8956 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13c8fa24-75eb-4aa8-8c2a-4c43e931b568} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 8944 269f0397358 tab
3⤵
PID:684

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.24.2138872567\232839328" -childID 22 -isForBrowser -prefsHandle 9524 -prefMapHandle 9516 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ef3aa3f5-4324-4417-a4f3-e5d42b3a4904} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 3892 269f22af858 tab
3⤵
PID:4560

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.25.1652210913\1877492367" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 9380 -prefMapHandle 9488 -prefsLen 26814 -prefMapSize 233414 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c25e179a-993b-49b2-82e9-0e4e621d2686} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 2680 269f2515458 utility
3⤵
PID:2536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.26.24164209\1101902962" -childID 23 -isForBrowser -prefsHandle 8944 -prefMapHandle 8928 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3673b05a-1120-44b1-853f-89a18756759a} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 8632 269f2496858 tab
3⤵
PID:5164

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.27.542180729\41085314" -childID 24 -isForBrowser -prefsHandle 5676 -prefMapHandle 6032 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03f84d86-b23b-4b37-9649-57def0df90b4} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 4944 269f2926258 tab
3⤵
PID:5604

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.28.178128380\963112558" -childID 25 -isForBrowser -prefsHandle 9348 -prefMapHandle 9444 -prefsLen 26814 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5d3f6c12-9421-4236-85e5-195886260df9} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 9032 269f297ed58 tab
3⤵
PID:5612

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.30.582502059\1714779291" -childID 27 -isForBrowser -prefsHandle 8476 -prefMapHandle 9408 -prefsLen 26854 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15a0f399-f15c-4285-bcfc-217e5d9ccf14} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 2580 269ec362558 tab
3⤵
PID:1580

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.29.130416187\1216189055" -childID 26 -isForBrowser -prefsHandle 8492 -prefMapHandle 2568 -prefsLen 26854 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fd2047fe-2ebc-4867-a037-34492e01ad2e} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 6052 269e8c12358 tab
3⤵
PID:3764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.31.634951994\1549158320" -childID 28 -isForBrowser -prefsHandle 8724 -prefMapHandle 5624 -prefsLen 26854 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {31e73491-2f23-4fe1-888a-afc8465016d3} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 8492 269ee83de58 tab
3⤵
PID:5596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3136.32.418458013\1012939842" -childID 29 -isForBrowser -prefsHandle 7636 -prefMapHandle 7724 -prefsLen 26854 -prefMapSize 233414 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8e769d76-acce-4e5f-8d25-af52a5d84cf8} 3136 "\\.\pipe\gecko-crash-server-pipe.3136" 7736 269ed984158 tab
3⤵
PID:5960

C:\Users\Admin\Downloads\Grand Theft Auto 6_k71-y31.exe
"C:\Users\Admin\Downloads\Grand Theft Auto 6_k71-y31.exe"
3⤵
- Executes dropped EXE
PID:4452

C:\Users\Admin\AppData\Local\Temp\is-BGFFV.tmp\Grand Theft Auto 6_k71-y31.tmp
"C:\Users\Admin\AppData\Local\Temp\is-BGFFV.tmp\Grand Theft Auto 6_k71-y31.tmp" /SL5="$110268,13603942,780800,C:\Users\Admin\Downloads\Grand Theft Auto 6_k71-y31.exe"
4⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks for any installed AV software in registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:5444

C:\Windows\SysWOW64\netsh.exe
"netsh" firewall add allowedprogramC:\Users\Admin\AppData\Local\Temp\is-BSSF1.tmp\qbittorrent.exe "qBittorrent" ENABLE
5⤵
- Modifies Windows Firewall
PID:4772

C:\Users\Admin\AppData\Local\Temp\is-BSSF1.tmp\qbittorrent.exe
"C:\Users\Admin\AppData\Local\Temp\is-BSSF1.tmp\qbittorrent.exe" magnet:?xt=urn:btih:BFF18AF5608F9196CF05BF0C1F0B54A18C3F0A77
5⤵
- Checks computer location settings
- Executes dropped EXE
- Enumerates connected drives
- Modifies registry class
- Modifies system certificate store
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5868

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:3572

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:5764

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
PID:5576

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
PID:5760

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5672

C:\Users\Admin\Downloads\Purble place\purble_place\Purble Place.exe
"C:\Users\Admin\Downloads\Purble place\purble_place\Purble Place.exe"
1⤵
- Drops file in Program Files directory
PID:2252

C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe
"C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe"
2⤵
- Executes dropped EXE
PID:4164

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scripting

T1064

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Scripting

T1064

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Query Registry

System Information Discovery