bb231edffd746ffcab7c11330e73036d096a6f80ad032da2f641e67acc7de662

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\winnt32.exe"	NoEscape.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	NoEscape.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 7 IoCs

pid	Process
1624	Buckshot Roulette.exe
6768	[email protected]
6860	NETFramework.exe
1952	Setup.exe
6584	[email protected]
4648	[email protected]
6148	NoEscape.exe

Loads dropped DLL 5 IoCs

pid	Process
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	NoEscape.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	NoEscape.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
191	camo.githubusercontent.com
192	camo.githubusercontent.com
193	camo.githubusercontent.com
214	raw.githubusercontent.com
215	raw.githubusercontent.com
239	raw.githubusercontent.com
194	camo.githubusercontent.com
216	raw.githubusercontent.com
217	raw.githubusercontent.com

Modifies WinLogon 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoAdminLogon = "0"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\DisableCAD = "1"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AutoRestartShell = "0"	NoEscape.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\noescape.png"	NoEscape.exe

Drops file in Windows directory 8 IoCs

description	ioc	Process
File created	C:\Windows\File Cache\IFEO.exe	[email protected]
File created	C:\Windows\File Cache\Driver.sys	[email protected]
File opened for modification	C:\Windows\File Cache\DLL.dll	[email protected]
File opened for modification	C:\Windows\File Cache\IFEO.exe	[email protected]
File opened for modification	C:\Windows\File Cache\Driver.sys	[email protected]
File created	C:\Windows\winnt32.exe	NoEscape.exe
File opened for modification	C:\Windows\winnt32.exe	NoEscape.exe
File created	C:\Windows\File Cache\DLL.dll	[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5604	6584	WerFault.exe	144
3532	4648	WerFault.exe	148

Checks processor information in registry 2 TTPs 10 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Setup.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Modifies Control Panel 4 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop\AutoColorization = "1"	NoEscape.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Mouse	NoEscape.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Mouse\SwapMouseButtons = "1"	NoEscape.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\Desktop	NoEscape.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "162"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\Spark.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\NoEscape.zip:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
6768	[email protected]
6768	[email protected]
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
1952	Setup.exe
6584	[email protected]
6584	[email protected]
4648	[email protected]
4648	[email protected]

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3168	7zFM.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
664	Process not Found

Suspicious use of AdjustPrivilegeToken 28 IoCs

description	pid	Process
Token: SeRestorePrivilege	3168	7zFM.exe
Token: 35	3168	7zFM.exe
Token: SeRestorePrivilege	2404	7zG.exe
Token: 35	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeSecurityPrivilege	2404	7zG.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeRestorePrivilege	6544	7zG.exe
Token: 35	6544	7zG.exe
Token: SeSecurityPrivilege	6544	7zG.exe
Token: SeSecurityPrivilege	6544	7zG.exe
Token: SeRestorePrivilege	6668	7zG.exe
Token: 35	6668	7zG.exe
Token: SeSecurityPrivilege	6668	7zG.exe
Token: SeSecurityPrivilege	6668	7zG.exe
Token: SeDebugPrivilege	6768	[email protected]
Token: SeDebugPrivilege	6584	[email protected]
Token: SeDebugPrivilege	4648	[email protected]
Token: SeDebugPrivilege	4580	firefox.exe
Token: SeRestorePrivilege	3956	7zG.exe
Token: 35	3956	7zG.exe
Token: SeSecurityPrivilege	3956	7zG.exe
Token: SeSecurityPrivilege	3956	7zG.exe

Suspicious use of FindShellTrayWindow 11 IoCs

pid	Process
3168	7zFM.exe
2404	7zG.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
6544	7zG.exe
6668	7zG.exe
4580	firefox.exe
4580	firefox.exe
3956	7zG.exe

Suspicious use of SendNotifyMessage 5 IoCs

pid	Process
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
1624	Buckshot Roulette.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
6860	NETFramework.exe
4580	firefox.exe
4580	firefox.exe
4580	firefox.exe
6856	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 3168	1968	cmd.exe	87
PID 1968 wrote to memory of 3168	1968	cmd.exe	87
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 1312 wrote to memory of 4580	1312	firefox.exe	105
PID 4580 wrote to memory of 1760	4580	firefox.exe	106
PID 4580 wrote to memory of 1760	4580	firefox.exe	106
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 3292	4580	firefox.exe	107
PID 4580 wrote to memory of 2852	4580	firefox.exe	108

System policy modification 1 TTPs 5 IoCs

evasion

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\UseDefaultTile = "1"	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NoEscape.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\shutdownwithoutlogon = "0"	NoEscape.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	NoEscape.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\B̷u̷c̷k̷s̷h̷o̷t̷ R̷o̷u̷l̷e̷t̷t̷e̷.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3168

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3676

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\AppData\Local\Temp\" -an -ai#7zMap21398:146:7zEvent24212
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2404

C:\Users\Admin\AppData\Local\Temp\Buckshot Roulette.exe
"C:\Users\Admin\AppData\Local\Temp\Buckshot Roulette.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.0.1543783905\2005083674" -parentBuildID 20221007134813 -prefsHandle 1896 -prefMapHandle 1888 -prefsLen 20749 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b76927d8-bd6b-46f4-9d7a-085d1af9f091} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 1976 281654db958 gpu
    3⤵
    PID:1760
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.1.613999135\248139236" -parentBuildID 20221007134813 -prefsHandle 2340 -prefMapHandle 2336 -prefsLen 20785 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7069f9d5-9b33-42dd-9092-8b3699180840} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 2360 28158c72558 socket
    3⤵
    - Checks processor information in registry
    PID:3292
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.2.2032850741\737563245" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 3076 -prefsLen 20888 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {aab88681-9fc8-4e1d-98ad-adf9cb4ac54e} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3048 281695a4858 tab
    3⤵
    PID:2852
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.3.1723479070\87670577" -childID 2 -isForBrowser -prefsHandle 3600 -prefMapHandle 3596 -prefsLen 26066 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d013d476-8b92-4a7e-9c93-535cc4f33449} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3608 28158c60758 tab
    3⤵
    PID:3712
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.4.1721023644\775894870" -childID 3 -isForBrowser -prefsHandle 3596 -prefMapHandle 3636 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c694961e-29c1-4ffe-a57a-9bc1051b2df0} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 3856 2816a7efb58 tab
    3⤵
    PID:5048
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.7.101301878\1530480274" -childID 6 -isForBrowser -prefsHandle 5444 -prefMapHandle 5448 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f7de4c4-8f6f-4642-a90b-0f366f61d1fb} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5528 2816b88aa58 tab
    3⤵
    PID:3480
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.6.1285485748\421083873" -childID 5 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b6443473-0281-48f2-a2ce-eaa060e986b6} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5248 2816b889858 tab
    3⤵
    PID:2368
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.5.892173551\1407529032" -childID 4 -isForBrowser -prefsHandle 5108 -prefMapHandle 5104 -prefsLen 26125 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {232346dc-3148-48f4-a324-8a5860d8095a} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5116 28166fa7858 tab
    3⤵
    PID:3796
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.9.1855148443\1012920652" -childID 8 -isForBrowser -prefsHandle 5428 -prefMapHandle 5424 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0323d21a-bbbc-4d3d-abbc-70e6634e72d3} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 6028 2816abe4058 tab
    3⤵
    PID:5656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.8.539895389\987602992" -childID 7 -isForBrowser -prefsHandle 4008 -prefMapHandle 3992 -prefsLen 26206 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {703a6dc7-0c57-4289-a9b7-c5ffee5c09ce} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5708 28166fa4b58 tab
    3⤵
    PID:5648
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.10.765336250\559835816" -parentBuildID 20221007134813 -prefsHandle 4008 -prefMapHandle 3992 -prefsLen 26206 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d3e47e8a-d131-4cd8-82ee-03950da06b90} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 6116 28168261858 rdd
    3⤵
    PID:5972
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4580.11.363658469\1931699534" -childID 9 -isForBrowser -prefsHandle 10224 -prefMapHandle 2860 -prefsLen 26381 -prefMapSize 233444 -jsInitHandle 1124 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2364d3d5-bcd8-44d5-aa9c-7af87f3b5322} 4580 "\\.\pipe\gecko-crash-server-pipe.4580" 5728 28166fa4858 tab
    3⤵
    PID:5780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault3342a3f1hc175h4fabhb104h8f607801e119
1⤵
PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x120,0x124,0x128,0xc0,0x12c,0x7ffe0a8b46f8,0x7ffe0a8b4708,0x7ffe0a8b4718
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12752937719679788300,1515001492655354723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2712 /prefetch:8
  2⤵
  PID:3880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6248

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\Spark\" -spe -an -ai#7zMap13082:72:7zEvent27509
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6544

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap25055:72:7zEvent9286
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:6668

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6768

C:\Users\Admin\Downloads\NETFramework.exe
"C:\Users\Admin\Downloads\NETFramework.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6860
- C:\73b9832479271a48a0c4dab6\Setup.exe
  C:\73b9832479271a48a0c4dab6\\Setup.exe /x86 /x64 /web
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:1952

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6584
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 6584 -s 1084
  2⤵
  - Program crash
  PID:5604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 6584 -ip 6584
1⤵
PID:5468

C:\Users\Admin\Downloads\[email protected]
"C:\Users\Admin\Downloads\[email protected]"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4648 -s 1128
  2⤵
  - Program crash
  PID:3532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4648 -ip 4648
1⤵
PID:4320

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\NoEscape\" -spe -an -ai#7zMap28831:78:7zEvent27510
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3956

C:\Users\Admin\Downloads\NoEscape\NoEscape.exe
"C:\Users\Admin\Downloads\NoEscape\NoEscape.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Modifies WinLogon
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- Modifies Control Panel
- System policy modification
PID:6148

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa395d855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:6856

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Credential Access

Discovery

Query Registry

T1012

System Information Discovery