ec33d8ee9c3881b8fcea18f9f862d5926d994553aec1b65081d925afd3e8b028

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	[email protected]

Blocks application from running via registry modification 18 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\0 = "msseces.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\3 = "egui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\11 = "avgcfgex.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\14 = "avgcmgr.exe"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\4 = "avgnt.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\6 = "avscan.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\9 = "avgtray.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\12 = "avgemc.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\15 = "avgwdsvc.exe"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun = "1"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\1 = "MSASCui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\5 = "avcenter.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\7 = "avgfrw.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\2 = "ekrn.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\8 = "avgui.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\10 = "avgscanx.exe"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\13 = "avgchsvx.exe"	[email protected]

Drops file in Drivers directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\System32\drivers\etc\hosts	[email protected]
File opened for modification	C:\Windows\system32\drivers\etc\hosts	[email protected]
File created	C:\Windows\system32\drivers\etc\host_new	[email protected]

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Unexpected DNS network traffic destination 36 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.222.222
Destination IP	208.67.220.220
Destination IP	208.67.222.222
Destination IP	208.67.222.222

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Run\AntiVirus Pro 2017 = "C:\\Users\\Admin\\Desktop\\Antivirus Pro 2017\\[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Run\Antivirus = "\"C:\\Program Files (x86)\\AnVi\\avt.exe\" -noscan"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Windows\CurrentVersion\Run\Internet Security Guard = "\"C:\\ProgramData\\28a08\\IS34e.exe\" /s /d"	[email protected]

Checks for any installed AV software in registry 1 TTPs 1 IoCs

Security Software Discovery

T1518.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\Nod\	[email protected]

Enumerates connected drives 3 TTPs 42 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\I:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\H:	[email protected]
File opened (read-only)	\??\N:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\Q:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\O:	[email protected]
File opened (read-only)	\??\I:	[email protected]

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rshell.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\advxdwin.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hacktracersetup.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\serv95.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssupdat.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fch32.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pgmonitr.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdfvwiz.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\oasrv.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\reged.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bvt.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cssupdat.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wsctool.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\stcloader.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avkservice.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avptc32.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wininitx.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\install[3].exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthLic.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vpc32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pop3trap.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cleaner.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\icmon.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navw32.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tvtmd.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\crashrep.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\BDSurvey.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fsaa.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lnetinfo.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsrte.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgserv.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\periscope.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoupdate.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VisthAux.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mwatch.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\netarmor.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AntivirusPlus\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\titaninxp.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\purge.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\hbinst.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\npscheck.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smss32.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ashWebSv.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fp-win.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\tds2-nt.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\brastk.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ODSW.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defalert.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wimmun32.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vet95.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmon016.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\fnrb32.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xpdeluxe.exe\Debugger = "svchost.exe"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msblast.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdsubwiz.exe	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\defscangui.exe	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ibmavsp.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\programauditor.exe\Debugger = "svchost.exe"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Security Center.exe\Debugger = "svchost.exe"	[email protected]

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	[email protected]
File opened for modification	\??\PhysicalDrive0	[email protected]

Drops file in System32 directory 22 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_48.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING3.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\INDEX.BTR	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_256.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\wbem\repository	svchost.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db	AnyDesk.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db	AnyDesk.exe
File opened for modification	C:\Windows\system32\wbem\repository\WRITABLE.TST	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING1.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\MAPPING2.MAP	svchost.exe
File opened for modification	C:\Windows\system32\wbem\repository\OBJECTS.DATA	svchost.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 12 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AnVi\splash.mp3	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\__tmp_rar_sfx_access_check_241049125	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\libltdl3.dll	[email protected]
File created	C:\Program Files (x86)\AnVi\virus.mp3	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\pthreadVC2.dll	[email protected]
File created	C:\Program Files (x86)\antiviruspc2009\bzip2.dll	[email protected]
File opened for modification	C:\Program Files (x86)\antiviruspc2009\avpc2009.exe	[email protected]

Executes dropped EXE 7 IoCs

pid	Process
5996	[email protected]
1076	[email protected]
200	[email protected]
5900	avpc2009.exe
5972	Process not Found
5992	[email protected]
3976	[email protected]

Loads dropped DLL 3 IoCs

pid	Process
5900	avpc2009.exe
5900	avpc2009.exe
5900	avpc2009.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AnyDesk.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AnyDesk.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\IIL = "0"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\ltTST = "32531"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\BrowserEmulation	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Main\Use FormSuggest = "Yes"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\ltHI = "0"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\Download\RunInvalidSignatures = "1"	[email protected]
Set value (int)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\MSCompatibilityMode = "0"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]

Modifies data under HKEY_USERS 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Key created	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-20\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]

Modifies registry class 16 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Software	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Local Settings	firefox.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ = "Implements DocHostUIHandler"	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Software\Microsoft	[email protected]
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\Clsid\ = "{3F2BBC05-40DF-11D2-9455-00104BC936FF}"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Software\Microsoft\Internet Explorer\SearchScopes\URL = "http://findgala.com/?&uid=7&q={searchTerms}"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\LocalServer32\ = "C:\\Users\\Admin\\Desktop\\InternetSecurityGuard\\[email protected]"	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\[email protected]\ = "Implements DocHostUIHandler"	[email protected]
Key created	\REGISTRY\USER\S-1-5-21-167039816-2868247564-2551780377-1000_Classes\Software\Microsoft\Internet Explorer	[email protected]
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3F2BBC05-40DF-11D2-9455-00104BC936FF}\ProgID\ = "[email protected]"	[email protected]

NTFS ADS 13 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\CleanThis.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\FakeAdwCleaner.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MEMZ.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus Pro 2017.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus Platinum.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Antivirus.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\FakeActivation.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Happy Antivirus.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Microsoft-Activation-Scripts-master.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Live Protection Suite 2019.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\InternetSecurityGuard.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\AnViPC2009.zip:Zone.Identifier	firefox.exe

Runs net.exe

Script User-Agent 3 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	272	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	273	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	274	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3336	AnyDesk.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4856	AnyDesk.exe
4856	AnyDesk.exe
4856	AnyDesk.exe
4856	AnyDesk.exe
4856	AnyDesk.exe
4856	AnyDesk.exe
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4584	AnyDesk.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4856	AnyDesk.exe
Token: 33	4092	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4092	AUDIODG.EXE
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeRestorePrivilege	6100	7zG.exe
Token: 35	6100	7zG.exe
Token: SeSecurityPrivilege	6100	7zG.exe
Token: SeSecurityPrivilege	6100	7zG.exe
Token: SeRestorePrivilege	684	7zG.exe
Token: 35	684	7zG.exe
Token: SeSecurityPrivilege	684	7zG.exe
Token: SeSecurityPrivilege	684	7zG.exe
Token: SeDebugPrivilege	812	firefox.exe
Token: SeSecurityPrivilege	5808	mofcomp.exe
Token: SeAssignPrimaryTokenPrivilege	4388	svchost.exe
Token: SeIncreaseQuotaPrivilege	4388	svchost.exe
Token: SeSecurityPrivilege	4388	svchost.exe
Token: SeTakeOwnershipPrivilege	4388	svchost.exe
Token: SeLoadDriverPrivilege	4388	svchost.exe
Token: SeSystemtimePrivilege	4388	svchost.exe
Token: SeBackupPrivilege	4388	svchost.exe
Token: SeRestorePrivilege	4388	svchost.exe
Token: SeShutdownPrivilege	4388	svchost.exe
Token: SeSystemEnvironmentPrivilege	4388	svchost.exe
Token: SeUndockPrivilege	4388	svchost.exe
Token: SeManageVolumePrivilege	4388	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	4388	svchost.exe
Token: SeIncreaseQuotaPrivilege	4388	svchost.exe
Token: SeSecurityPrivilege	4388	svchost.exe
Token: SeTakeOwnershipPrivilege	4388	svchost.exe
Token: SeLoadDriverPrivilege	4388	svchost.exe
Token: SeSystemtimePrivilege	4388	svchost.exe
Token: SeBackupPrivilege	4388	svchost.exe
Token: SeRestorePrivilege	4388	svchost.exe
Token: SeShutdownPrivilege	4388	svchost.exe
Token: SeSystemEnvironmentPrivilege	4388	svchost.exe
Token: SeUndockPrivilege	4388	svchost.exe
Token: SeManageVolumePrivilege	4388	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	4388	svchost.exe
Token: SeIncreaseQuotaPrivilege	4388	svchost.exe
Token: SeSecurityPrivilege	4388	svchost.exe
Token: SeTakeOwnershipPrivilege	4388	svchost.exe
Token: SeLoadDriverPrivilege	4388	svchost.exe
Token: SeSystemtimePrivilege	4388	svchost.exe
Token: SeBackupPrivilege	4388	svchost.exe
Token: SeRestorePrivilege	4388	svchost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
6100	7zG.exe
684	7zG.exe
5996	[email protected]
5996	[email protected]
5996	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
5900	avpc2009.exe
5900	avpc2009.exe
1076	[email protected]
5992	[email protected]
1076	[email protected]
1076	[email protected]
5992	[email protected]
5996	[email protected]
5996	[email protected]
5996	[email protected]
3976	[email protected]
3976	[email protected]

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
3336	AnyDesk.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
5996	[email protected]
5996	[email protected]
5996	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
5900	avpc2009.exe
5992	[email protected]
5996	[email protected]
5996	[email protected]
5996	[email protected]
3976	[email protected]
3976	[email protected]

Suspicious use of SetWindowsHookEx 62 IoCs

pid	Process
4584	AnyDesk.exe
4584	AnyDesk.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
812	firefox.exe
5996	[email protected]
5996	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
1076	[email protected]
5900	avpc2009.exe
5900	avpc2009.exe
5972	Process not Found
1076	[email protected]
1076	[email protected]
3976	[email protected]
3976	[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 4856	4132	AnyDesk.exe	73
PID 4132 wrote to memory of 4856	4132	AnyDesk.exe	73
PID 4132 wrote to memory of 4856	4132	AnyDesk.exe	73
PID 4132 wrote to memory of 3336	4132	AnyDesk.exe	74
PID 4132 wrote to memory of 3336	4132	AnyDesk.exe	74
PID 4132 wrote to memory of 3336	4132	AnyDesk.exe	74
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 600 wrote to memory of 812	600	firefox.exe	82
PID 812 wrote to memory of 4524	812	firefox.exe	85
PID 812 wrote to memory of 4524	812	firefox.exe	85
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86
PID 812 wrote to memory of 212	812	firefox.exe	86

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
"C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe"
1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-service
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4856
- - C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
    "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --backend
    3⤵
    - Drops file in System32 directory
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of SetWindowsHookEx
    PID:4584
- C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe
  "C:\Users\Admin\AppData\Local\Temp\AnyDesk.exe" --local-control
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:3336

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3f0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:812
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.0.788359572\1125354146" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1692 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cf9a2f59-096f-4f79-b9c7-8e20f5cbb82b} 812 "\\.\pipe\gecko-crash-server-pipe.812" 1780 2760b2d6358 gpu
  2⤵
  PID:4524
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.1.181248527\1894794123" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {783c70a2-0b60-4fa7-af2f-0ad4cb22b1a1} 812 "\\.\pipe\gecko-crash-server-pipe.812" 2136 27600170a58 socket
  2⤵
  PID:212
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.2.2007565347\473489190" -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3060 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {60f27203-5df5-4e84-91d3-19f6f907c084} 812 "\\.\pipe\gecko-crash-server-pipe.812" 2924 2760f5d3558 tab
  2⤵
  PID:3136
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.3.1182293576\632249548" -childID 2 -isForBrowser -prefsHandle 3476 -prefMapHandle 3472 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {29e7930e-c7d5-41db-be83-c7c9100c586e} 812 "\\.\pipe\gecko-crash-server-pipe.812" 3488 27600161f58 tab
  2⤵
  PID:3864
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.4.1061491019\102709483" -childID 3 -isForBrowser -prefsHandle 4256 -prefMapHandle 4248 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e967dd9e-57ce-4985-8f6a-d804addb62dc} 812 "\\.\pipe\gecko-crash-server-pipe.812" 4268 27610ae0e58 tab
  2⤵
  PID:5140
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.5.1998660530\891485137" -childID 4 -isForBrowser -prefsHandle 4884 -prefMapHandle 4880 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ccb274d4-e5de-4774-a431-729d12c32086} 812 "\\.\pipe\gecko-crash-server-pipe.812" 4868 2761139d658 tab
  2⤵
  PID:5544
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.7.896244324\711266826" -childID 6 -isForBrowser -prefsHandle 5176 -prefMapHandle 5180 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a2fb2640-9350-48c2-ba03-87f8af61af8c} 812 "\\.\pipe\gecko-crash-server-pipe.812" 5168 27612433d58 tab
  2⤵
  PID:5560
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.6.840480959\791622818" -childID 5 -isForBrowser -prefsHandle 4996 -prefMapHandle 5000 -prefsLen 26247 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {873d9ab7-e498-4096-bd2e-e23fbfacf2d6} 812 "\\.\pipe\gecko-crash-server-pipe.812" 4988 2761139d958 tab
  2⤵
  PID:5552
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.8.1778255030\226206410" -childID 7 -isForBrowser -prefsHandle 5524 -prefMapHandle 5580 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5984c4fb-1cf3-499f-a782-608f9f37fb5f} 812 "\\.\pipe\gecko-crash-server-pipe.812" 5256 276114bb658 tab
  2⤵
  PID:6052
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.9.1604181610\1321962708" -childID 8 -isForBrowser -prefsHandle 5360 -prefMapHandle 3152 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {cd25eb3f-2755-4cdd-9f4f-f60893711810} 812 "\\.\pipe\gecko-crash-server-pipe.812" 4932 2761246a258 tab
  2⤵
  PID:5076
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.10.305460718\1234618690" -childID 9 -isForBrowser -prefsHandle 5960 -prefMapHandle 5904 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f104ddbf-14cd-4107-bb1c-66217c54a184} 812 "\\.\pipe\gecko-crash-server-pipe.812" 4512 27614ad6258 tab
  2⤵
  PID:3328
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.12.1317577636\1564057668" -childID 11 -isForBrowser -prefsHandle 5244 -prefMapHandle 5408 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {167c56fc-3b2e-4251-99f1-7f324adaa2f7} 812 "\\.\pipe\gecko-crash-server-pipe.812" 5248 27614f4b258 tab
  2⤵
  PID:4420
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.11.1326821511\769725831" -childID 10 -isForBrowser -prefsHandle 3960 -prefMapHandle 5276 -prefsLen 26808 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ad3675a-acc0-4908-94dd-cad5e6c98b14} 812 "\\.\pipe\gecko-crash-server-pipe.812" 5304 27614ea7058 tab
  2⤵
  PID:5060
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.13.1555299261\2102921662" -parentBuildID 20221007134813 -prefsHandle 9000 -prefMapHandle 5332 -prefsLen 26808 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a901cc5d-0ed3-4a3a-8ce8-fcfd1f4884ed} 812 "\\.\pipe\gecko-crash-server-pipe.812" 6120 2761528c658 rdd
  2⤵
  PID:4520
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="812.14.1796162842\1005498238" -childID 12 -isForBrowser -prefsHandle 5344 -prefMapHandle 4188 -prefsLen 26817 -prefMapSize 233444 -jsInitHandle 1376 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c6273ba-e362-4ec7-afbb-c8355a742514} 812 "\\.\pipe\gecko-crash-server-pipe.812" 10040 2761468be58 tab
  2⤵
  PID:1896

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5528

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\*\" -spe -an -ai#7zMap15268:708:7zEvent10763
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6100

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Desktop\*\" -spe -an -ai#7zMap24481:308:7zEvent19641
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:684

C:\Users\Admin\Desktop\Antivirus Pro 2017\[email protected]
"C:\Users\Admin\Desktop\Antivirus Pro 2017\[email protected]"
1⤵
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:5996

C:\Users\Admin\Desktop\Antivirus\[email protected]
"C:\Users\Admin\Desktop\Antivirus\[email protected]"
1⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1076
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp C:\Users\Admin\AppData\Local\Temp\4otjesjty.mof
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5808
- C:\Windows\SysWOW64\net.exe
  net start wscsvc
  2⤵
  PID:5780
- C:\Windows\SysWOW64\net.exe
  net start winmgmt
  2⤵
  PID:5776
- C:\Windows\SysWOW64\net.exe
  net stop winmgmt /y
  2⤵
  PID:3096
- C:\Windows\SysWOW64\net.exe
  net stop wscsvc
  2⤵
  PID:604

C:\Users\Admin\Desktop\AnViPC2009\[email protected]
"C:\Users\Admin\Desktop\AnViPC2009\[email protected]"
1⤵
- Drops file in Program Files directory
- Executes dropped EXE
PID:200
- C:\Program Files (x86)\antiviruspc2009\avpc2009.exe
  "C:\Program Files (x86)\antiviruspc2009\avpc2009.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:5900

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop winmgmt /y
1⤵
PID:692

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start winmgmt
1⤵
PID:5132

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wscsvc
1⤵
PID:2936

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 start wscsvc
1⤵
PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -s Winmgmt
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Admin\Desktop\MEMZ\[email protected]
"C:\Users\Admin\Desktop\MEMZ\[email protected]"
1⤵
PID:5972

C:\Users\Admin\Desktop\Happy Antivirus\[email protected]
"C:\Users\Admin\Desktop\Happy Antivirus\[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5992

C:\Users\Admin\Desktop\InternetSecurityGuard\[email protected]
"C:\Users\Admin\Desktop\InternetSecurityGuard\[email protected]"
1⤵
- Enumerates VirtualBox registry keys
- Blocks application from running via registry modification
- Drops file in Drivers directory
- Adds Run key to start application
- Checks for any installed AV software in registry
- Enumerates connected drives
- Sets file execution options in registry
- Writes to the Master Boot Record (MBR)
- Executes dropped EXE
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3976
- C:\Windows\SysWOW64\netsh.exe
  netsh "firewall" add allowedprogram "C:\Users\Admin\Desktop\InternetSecurityGuard\[email protected]" "Internet Security Guard" ENABLE
  2⤵
  PID:4804
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.com 8.8.8.8
  2⤵
  PID:688
- C:\Windows\SysWOW64\Wbem\mofcomp.exe
  mofcomp "C:\Users\Admin\Desktop\InternetSecurityGuard\3662.mof"
  2⤵
  PID:3064
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.net 8.8.8.8
  2⤵
  PID:4396
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.com 208.67.222.222
  2⤵
  PID:4440
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5132
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.net 208.67.222.222
  2⤵
  PID:1868
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.com 8.8.4.4
  2⤵
  PID:2876
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.net 8.8.4.4
  2⤵
  PID:4392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.com 208.67.220.220
  2⤵
  PID:3008
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt djmuz612iirstah.net 208.67.220.220
  2⤵
  PID:4276
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.com 8.8.8.8
  2⤵
  PID:2864
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.net 8.8.8.8
  2⤵
  PID:5388
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.com 208.67.222.222
  2⤵
  PID:3568
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.net 208.67.222.222
  2⤵
  PID:3944
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.com 8.8.4.4
  2⤵
  PID:976
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.net 8.8.4.4
  2⤵
  PID:5492
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.com 208.67.220.220
  2⤵
  PID:5824
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt ddlua510gpucdip.net 208.67.220.220
  2⤵
  PID:4440
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.com 8.8.8.8
  2⤵
  PID:6056
- - C:\Windows\System32\Conhost.exe
    \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
    3⤵
    PID:5776
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.net 8.8.8.8
  2⤵
  PID:2680
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.com 208.67.222.222
  2⤵
  PID:6072
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.net 208.67.222.222
  2⤵
  PID:5564
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.com 8.8.4.4
  2⤵
  PID:5496
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.net 8.8.4.4
  2⤵
  PID:1000
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.com 208.67.220.220
  2⤵
  PID:4392
- C:\Windows\SysWOW64\nslookup.exe
  nslookup -q=txt clls406szhipps.net 208.67.220.220
  2⤵
  PID:1432

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:2936

C:\Users\Admin\Desktop\Live Protection Suite 2019\[email protected]
"C:\Users\Admin\Desktop\Live Protection Suite 2019\[email protected]"
1⤵
PID:4052
- C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe
  "C:\Program Files (x86)\HjuTygFcvX\lpsprt.exe"
  2⤵
  PID:6008

C:\Users\Admin\Desktop\FakeAdwCleaner\[email protected]
"C:\Users\Admin\Desktop\FakeAdwCleaner\[email protected]"
1⤵
PID:6120
- C:\Users\Admin\AppData\Local\6AdwCleaner.exe
  "C:\Users\Admin\AppData\Local\6AdwCleaner.exe"
  2⤵
  PID:4052

C:\Users\Admin\Desktop\CleanThis\[email protected]
"C:\Users\Admin\Desktop\CleanThis\[email protected]"
1⤵
PID:4544

C:\Windows\system32\svchost.exe
svchost.exe "C:\Windows\system32\taskmgr.exe" /4
1⤵
PID:4300

C:\Windows\system32\svchost.exe
svchost.exe "C:\Windows\system32\taskmgr.exe" /0
1⤵
PID:5788

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0 /state0:0xa3a86855 /state1:0x41c64e6d
1⤵
PID:4684

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry