healer | e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	g5140893.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	g5140893.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	g5140893.exe

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023239-26.dat	family_redline
behavioral2/memory/4596-28-0x0000000000760000-0x0000000000790000-memory.dmp	family_redline

Executes dropped EXE 4 IoCs

pid	Process
1936	x8180539.exe
4464	x8801353.exe
3652	g5140893.exe
4596	i5032787.exe

Windows security modification 2 TTPs 1 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features\TamperProtection = "0"	g5140893.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\""	x8180539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\""	x8801353.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
3652	g5140893.exe
3652	g5140893.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
5812	msedge.exe
5812	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
1268	identity_helper.exe
1268	identity_helper.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe
4788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	3652	g5140893.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: 33	5584	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5584	AUDIODG.EXE
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	2548	firefox.exe
Token: SeDebugPrivilege	4672	taskmgr.exe
Token: SeSystemProfilePrivilege	4672	taskmgr.exe
Token: SeCreateGlobalPrivilege	4672	taskmgr.exe
Token: 33	4672	taskmgr.exe
Token: SeIncBasePriorityPrivilege	4672	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
4672	taskmgr.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe
2548	firefox.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2548	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 1936	4040	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 4040 wrote to memory of 1936	4040	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 4040 wrote to memory of 1936	4040	JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe	85
PID 1936 wrote to memory of 4464	1936	x8180539.exe	87
PID 1936 wrote to memory of 4464	1936	x8180539.exe	87
PID 1936 wrote to memory of 4464	1936	x8180539.exe	87
PID 4464 wrote to memory of 3652	4464	x8801353.exe	88
PID 4464 wrote to memory of 3652	4464	x8801353.exe	88
PID 4464 wrote to memory of 4596	4464	x8801353.exe	96
PID 4464 wrote to memory of 4596	4464	x8801353.exe	96
PID 4464 wrote to memory of 4596	4464	x8801353.exe	96
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 1460 wrote to memory of 2548	1460	firefox.exe	99
PID 2548 wrote to memory of 2608	2548	firefox.exe	100
PID 2548 wrote to memory of 2608	2548	firefox.exe	100
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101
PID 2548 wrote to memory of 4892	2548	firefox.exe	101

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe
"C:\Users\Admin\AppData\Local\Temp\JC_e3cc6620516dbea63b618fcc57d399f3189b105ec90a4ce0bbb9add1eda7e6ea.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8180539.exe
  C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\x8180539.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe
    C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\x8801353.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5140893.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\g5140893.exe
      4⤵
      Modifies Windows Defender Real-time Protection settings
      Executes dropped EXE
      Windows security modification
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5032787.exe
      C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\i5032787.exe
      4⤵
      Executes dropped EXE
      PID:4596

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2548
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.0.47637765\87627224" -parentBuildID 20221007134813 -prefsHandle 1876 -prefMapHandle 1868 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {995a2de7-5501-4188-9961-c017ded49876} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 1964 1b19a3d2758 gpu
    3⤵
    PID:2608
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.1.1494808449\2075390484" -parentBuildID 20221007134813 -prefsHandle 2352 -prefMapHandle 2348 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {729879ae-fe1f-47b3-80e1-a93b6d22889b} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 2364 1b18da72b58 socket
    3⤵
    - Checks processor information in registry
    PID:4892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.2.1896980119\921501017" -childID 1 -isForBrowser -prefsHandle 3192 -prefMapHandle 3188 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {47cb01a6-d72d-4f59-aa81-2dcae197d8f8} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 3164 1b19a35bc58 tab
    3⤵
    PID:628
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.3.684290584\2036563722" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8596517c-db18-47ec-a4aa-b8ea83c43e41} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 3644 1b19e4ba358 tab
    3⤵
    PID:2064
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.4.1130380535\1080940293" -childID 3 -isForBrowser -prefsHandle 4420 -prefMapHandle 4416 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {af1fd2cc-91bd-4831-8453-d0bba5a5a5d0} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 4428 1b1a00ede58 tab
    3⤵
    PID:4444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.7.974242995\984962522" -childID 6 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0a063985-a0f2-4df0-b18e-7b4111dd635a} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 5448 1b1a06b4258 tab
    3⤵
    PID:1408
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.6.2042927665\300121739" -childID 5 -isForBrowser -prefsHandle 5268 -prefMapHandle 5272 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {330ccdba-6232-4f89-8575-4affa10a5f4c} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 5260 1b1a06b2d58 tab
    3⤵
    PID:2304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.5.1490436810\430194327" -childID 4 -isForBrowser -prefsHandle 4980 -prefMapHandle 5004 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {018be28d-abc5-42cf-a009-484e3d19281c} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 5128 1b1a06b2458 tab
    3⤵
    PID:3196
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.8.2054348731\1247577442" -parentBuildID 20221007134813 -prefsHandle 5832 -prefMapHandle 5136 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b46cbac9-4bfd-43b7-b62a-b0c58f63ce25} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 5840 1b1a2788f58 rdd
    3⤵
    PID:1116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.9.560966603\1629475774" -childID 7 -isForBrowser -prefsHandle 5980 -prefMapHandle 5832 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {149e5780-76a6-4ea2-8e70-f919bc130c1b} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 5992 1b1a27ac258 tab
    3⤵
    PID:3232
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.10.1677508538\156001176" -childID 8 -isForBrowser -prefsHandle 6296 -prefMapHandle 6300 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba0fdd48-9d86-4613-92a5-ff522cbd9cce} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 6316 1b1a2aa2b58 tab
    3⤵
    PID:5220
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.11.911257518\961410775" -childID 9 -isForBrowser -prefsHandle 6524 -prefMapHandle 6528 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ad4f3f30-8232-4cb6-b904-89b7850de3ac} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 6512 1b1a2aa4358 tab
    3⤵
    PID:5264
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.12.305051668\265039604" -childID 10 -isForBrowser -prefsHandle 6696 -prefMapHandle 6620 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1396 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d65a98e-a5dc-4ad6-9faf-0d5890196c99} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 6608 1b1a2aa3d58 tab
    3⤵
    PID:5272
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2548.13.585143486\1898924754" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 5620 -prefMapHandle 5772 -prefsLen 26381 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {10af1dd1-078f-40e4-be9d-0d2394275879} 2548 "\\.\pipe\gecko-crash-server-pipe.2548" 4672 1b19e30aa58 utility
    3⤵
    PID:5560

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x424 0x4a0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5584

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb616446f8,0x7ffb61644708,0x7ffb61644718
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5847557882859564694,8450588961631816073,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3644 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery