bac3b3dcd4483eca9ff5c5e9701484eed2d31ca63f38707a41d075405d8448e6

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	loader.exe

Downloads MZ/PE file

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	loader.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	loader.exe

Executes dropped EXE 9 IoCs

pid	Process
5892	python-3.11.5-amd64.exe
5924	python-3.11.5-amd64.exe
5292	python-3.11.5-amd64.exe
2400	python.exe
5728	python.exe
6024	loader.exe
2368	loader.exe
4896	loader.exe
4120	loader.exe

Loads dropped DLL 47 IoCs

pid	Process
5924	python-3.11.5-amd64.exe
3268	MsiExec.exe
2400	python.exe
2400	python.exe
2400	python.exe
2400	python.exe
2400	python.exe
2400	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
5728	python.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
2368	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe
4120	loader.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ = "C:\\Windows\\pyshellext.amd64.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\CLSID\{BEA218D2-6950-497B-9434-61683EC065FE}\InprocServer32	msiexec.exe

Themida packer 3 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral1/memory/6024-13648-0x00007FF7324A0000-0x00007FF7332F6000-memory.dmp	themida
behavioral1/memory/6024-13749-0x00007FF7324A0000-0x00007FF7332F6000-memory.dmp	themida
behavioral1/memory/4896-13851-0x00007FF7324A0000-0x00007FF7332F6000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\{2001d062-3b62-4fc6-a275-e9fa5ad9c809} = "\"C:\\Users\\Admin\\AppData\\Local\\Package Cache\\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}\\python-3.11.5-amd64.exe\" /burn.runonce"	python-3.11.5-amd64.exe

Blocklisted process makes network request 1 IoCs

flow	pid	Process
179	328	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	loader.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\e59500a.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{896CE1B5-5393-426C-A466-4465EEAE1363}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B1D86A26-1D57-45EE-AAAD-2E19018A6376}	msiexec.exe
File created	C:\Windows\Installer\e595036.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595014.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI62BE.tmp	msiexec.exe
File created	C:\Windows\Installer\e595022.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2EB6BD56-25CA-49CB-8CFD-B03D872B8239}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{1BA18593-41AB-434B-B31F-EEC8BBA9612A}	msiexec.exe
File created	C:\Windows\py.exe	msiexec.exe
File created	C:\Windows\Installer\SourceHash{57527742-12D9-4E19-ACFF-6A7B0A88D23A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID677.tmp	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\e59502d.msi	msiexec.exe
File created	C:\Windows\pyw.exe	msiexec.exe
File created	C:\Windows\Installer\{2FB71770-2C2E-42A3-9136-5101D1E930F4}\ARPIcon	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\e59500f.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{6D4BE933-74FA-43A6-B654-CC1BCEF568D5}	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File opened for modification	C:\Windows\Installer\MSIE90B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e595028.msi	msiexec.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe
File created	C:\Windows\Installer\SourceHash{C62CE14B-8E3D-4A41-8671-405CA705DDF2}	msiexec.exe
File opened for modification	C:\Windows\Installer\e59500a.msi	msiexec.exe
File created	C:\Windows\Installer\e595014.msi	msiexec.exe
File created	C:\Windows\Installer\e59501d.msi	msiexec.exe
File created	C:\Windows\Installer\e595028.msi	msiexec.exe
File created	C:\Windows\Installer\e59500e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI5A07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59503c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI58E7.tmp	msiexec.exe
File created	C:\Windows\Installer\e595019.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595019.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{CDE4410B-99CE-46EB-B88B-9881AE7E7438}	msiexec.exe
File created	C:\Windows\Installer\e595023.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI76F9.tmp	msiexec.exe
File created	C:\Windows\Installer\e59503b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595023.msi	msiexec.exe
File created	C:\Windows\Installer\e595027.msi	msiexec.exe
File created	C:\Windows\Installer\e59502c.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI53A4.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{2FB71770-2C2E-42A3-9136-5101D1E930F4}	msiexec.exe
File created	C:\Windows\pyshellext.amd64.dll	msiexec.exe
File opened for modification	C:\Windows\Installer\{2FB71770-2C2E-42A3-9136-5101D1E930F4}\ARPIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\e595037.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6F6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3AA4.tmp	msiexec.exe
File created	C:\Windows\Installer\e595018.msi	msiexec.exe
File created	C:\Windows\Installer\e59501e.msi	msiexec.exe
File created	C:\Windows\Installer\e595031.msi	msiexec.exe
File created	C:\Windows\Installer\e59503c.msi	msiexec.exe
File created	C:\Windows\Installer\e595013.msi	msiexec.exe
File created	C:\Windows\Installer\e59502d.msi	msiexec.exe
File created	C:\Windows\Installer\e595032.msi	msiexec.exe
File created	C:\Windows\Installer\e59500f.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7A11.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e59501e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e595032.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICFEC.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies data under HKEY_USERS 3 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\1A\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1a	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\1b	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{CDE4410B-99CE-46EB-B88B-9881AE7E7438}	python-3.11.5-amd64.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.pyw	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\TrustedPublisher\CTLs	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{0FEE67DA-831A-442F-A7B1-D709EF005148}\ = "{0FEE67DA-831A-442F-A7B1-D709EF005148}"	python-3.11.5-amd64.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\Content\CacheLimit = "256000"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{CDE4410B-99CE-46EB-B88B-9881AE7E7438}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{6D4BE933-74FA-43A6-B654-CC1BCEF568D5}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings	cmd.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.ArchiveFile	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMic	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "1373"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{2EB6BD56-25CA-49CB-8CFD-B03D872B8239}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{896CE1B5-5393-426C-A466-4465EEAE1363}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\DefaultIcon\ = "\"C:\\Windows\\py.exe\",1"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\Internet Settings\Cache\History\CacheLimit = "1"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\TreeView = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\JumpListFirstRun = "3"	MicrosoftEdge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.pyzw\ = "Python.NoConArchiveFile"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07717BF2E2C23A24196315101D9E034F\SourceList\PackageName = "launcher.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{1BA18593-41AB-434B-B31F-EEC8BBA9612A}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\004\ACGStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.CompiledFile\shell	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open\command\ = "\"C:\\Windows\\py.exe\" \"%L\" %*"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\ = "Python File"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Revision = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Python.NoConFile\Shell\editwithidle\MUIVerb = "&Edit with IDLE"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\PersistedStorageItemTable\System\{7EF9AA58-872C-48C2-BCE0-79DF2DC15BE	browser_broker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{B1D86A26-1D57-45EE-AAAD-2E19018A6376}\Version = "3.11.5150.0"	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\{B1D86A26-1D57-45EE-AAAD-2E19018A6376}\Dependents\{2001d062-3b62-4fc6-a275-e9fa5ad9c809}	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 41e810707f67da01	MicrosoftEdge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Installer\Dependencies\CPython-3.11\Version = "3.11.5150.0"	python-3.11.5-amd64.exe
Key created	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CRLs	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.NoConFile\shellex	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\ = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Python.File\shell\open	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07717BF2E2C23A24196315101D9E034F\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Package Cache\\{2FB71770-2C2E-42A3-9136-5101D1E930F4}v3.11.5150.0\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 23e413857f67da01	MicrosoftEdge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Python.ArchiveFile\DefaultIcon	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07717BF2E2C23A24196315101D9E034F\ProductIcon = "C:\\Windows\\Installer\\{2FB71770-2C2E-42A3-9136-5101D1E930F4}\\ARPIcon"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.py\Content Type = "text/x-python"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\07717BF2E2C23A24196315101D9E034F\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DeviceId = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3360119756-166634443-3920521668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"	MicrosoftEdge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\python-3.11.5-amd64.exe.go58jlb.partial:Zone.Identifier	browser_broker.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe
328	msiexec.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
372	7zFM.exe

Suspicious behavior: MapViewOfSection 10 IoCs

pid	Process
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	372	7zFM.exe
Token: 35	372	7zFM.exe
Token: SeDebugPrivilege	1920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1920	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	1208	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	752	MicrosoftEdge.exe
Token: SeDebugPrivilege	752	MicrosoftEdge.exe
Token: SeBackupPrivilege	5460	vssvc.exe
Token: SeRestorePrivilege	5460	vssvc.exe
Token: SeAuditPrivilege	5460	vssvc.exe
Token: SeShutdownPrivilege	5924	python-3.11.5-amd64.exe
Token: SeIncreaseQuotaPrivilege	5924	python-3.11.5-amd64.exe
Token: SeSecurityPrivilege	328	msiexec.exe
Token: SeCreateTokenPrivilege	5924	python-3.11.5-amd64.exe
Token: SeAssignPrimaryTokenPrivilege	5924	python-3.11.5-amd64.exe
Token: SeLockMemoryPrivilege	5924	python-3.11.5-amd64.exe
Token: SeIncreaseQuotaPrivilege	5924	python-3.11.5-amd64.exe
Token: SeMachineAccountPrivilege	5924	python-3.11.5-amd64.exe
Token: SeTcbPrivilege	5924	python-3.11.5-amd64.exe
Token: SeSecurityPrivilege	5924	python-3.11.5-amd64.exe
Token: SeTakeOwnershipPrivilege	5924	python-3.11.5-amd64.exe
Token: SeLoadDriverPrivilege	5924	python-3.11.5-amd64.exe
Token: SeSystemProfilePrivilege	5924	python-3.11.5-amd64.exe
Token: SeSystemtimePrivilege	5924	python-3.11.5-amd64.exe
Token: SeProfSingleProcessPrivilege	5924	python-3.11.5-amd64.exe
Token: SeIncBasePriorityPrivilege	5924	python-3.11.5-amd64.exe
Token: SeCreatePagefilePrivilege	5924	python-3.11.5-amd64.exe
Token: SeCreatePermanentPrivilege	5924	python-3.11.5-amd64.exe
Token: SeBackupPrivilege	5924	python-3.11.5-amd64.exe
Token: SeRestorePrivilege	5924	python-3.11.5-amd64.exe
Token: SeShutdownPrivilege	5924	python-3.11.5-amd64.exe
Token: SeDebugPrivilege	5924	python-3.11.5-amd64.exe
Token: SeAuditPrivilege	5924	python-3.11.5-amd64.exe
Token: SeSystemEnvironmentPrivilege	5924	python-3.11.5-amd64.exe
Token: SeChangeNotifyPrivilege	5924	python-3.11.5-amd64.exe
Token: SeRemoteShutdownPrivilege	5924	python-3.11.5-amd64.exe
Token: SeUndockPrivilege	5924	python-3.11.5-amd64.exe
Token: SeSyncAgentPrivilege	5924	python-3.11.5-amd64.exe
Token: SeEnableDelegationPrivilege	5924	python-3.11.5-amd64.exe
Token: SeManageVolumePrivilege	5924	python-3.11.5-amd64.exe
Token: SeImpersonatePrivilege	5924	python-3.11.5-amd64.exe
Token: SeCreateGlobalPrivilege	5924	python-3.11.5-amd64.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe
Token: SeTakeOwnershipPrivilege	328	msiexec.exe
Token: SeRestorePrivilege	328	msiexec.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
372	7zFM.exe
5924	python-3.11.5-amd64.exe
372	7zFM.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
752	MicrosoftEdge.exe
2640	MicrosoftEdgeCP.exe
1920	MicrosoftEdgeCP.exe
1844	MicrosoftEdgeCP.exe
2640	MicrosoftEdgeCP.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 372	1628	cmd.exe	81
PID 1628 wrote to memory of 372	1628	cmd.exe	81
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 5044	2640	MicrosoftEdgeCP.exe	93
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 2756	2640	MicrosoftEdgeCP.exe	98
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100
PID 2640 wrote to memory of 5024	2640	MicrosoftEdgeCP.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\aquatic_cracked_improved.rar
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Program Files\7-Zip\7zFM.exe
  "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\aquatic_cracked_improved.rar"
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:372

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.3.958750871\340414894" -childID 2 -isForBrowser -prefsHandle 2040 -prefMapHandle 2036 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ba379a8a-0f9f-4ad1-89e5-b1a50ac3705d} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 1132 1b8d510c558 tab
1⤵
PID:4892

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.4.1302388615\666548870" -childID 3 -isForBrowser -prefsHandle 3624 -prefMapHandle 3620 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7b140321-4be4-495b-bebe-36a1e83f84bf} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 3636 1b8c5962b58 tab
1⤵
PID:4480

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.5.113267227\1876484069" -childID 4 -isForBrowser -prefsHandle 4456 -prefMapHandle 4568 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {baae13db-2be4-47f0-8e50-58302cf46dc6} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 4540 1b8d3996e58 tab
1⤵
PID:3108

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.6.423387748\249203521" -childID 5 -isForBrowser -prefsHandle 4584 -prefMapHandle 4580 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {79b32cea-3a2c-47a5-b6e9-68f181389c6a} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 4556 1b8d6ae8458 tab
1⤵
PID:4316

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.7.38750911\1815177531" -childID 6 -isForBrowser -prefsHandle 4540 -prefMapHandle 4584 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {40355e90-2b64-487d-8bb8-a71c2abe800d} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 4520 1b8d6bd0758 tab
1⤵
PID:332

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4224.8.1061835801\41102428" -childID 7 -isForBrowser -prefsHandle 5360 -prefMapHandle 5364 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 888 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {432c5bee-e342-4c38-aea9-73d5095cf758} 4224 "\\.\pipe\gecko-crash-server-pipe.4224" 5340 1b8d6867858 tab
1⤵
PID:5092

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:752

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- NTFS ADS
PID:5088
- C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\python-3.11.5-amd64.exe
  "C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\python-3.11.5-amd64.exe"
  2⤵
  - Executes dropped EXE
  PID:5892
- - C:\Windows\Temp\{2E5DAA4A-68DD-4E41-9F22-444E5960D1B7}\.cr\python-3.11.5-amd64.exe
    "C:\Windows\Temp\{2E5DAA4A-68DD-4E41-9F22-444E5960D1B7}\.cr\python-3.11.5-amd64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\TempState\Downloads\python-3.11.5-amd64.exe" -burn.filehandle.attached=540 -burn.filehandle.self=536
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:5924
  - - C:\Windows\Temp\{8805F008-0932-4999-8C1B-DFC34E4452F8}\.be\python-3.11.5-amd64.exe
      "C:\Windows\Temp\{8805F008-0932-4999-8C1B-DFC34E4452F8}\.be\python-3.11.5-amd64.exe" -q -burn.elevated BurnPipe.{15F5BCA1-A698-4292-9468-5A746A2AA7AB} {EFC26802-DD5F-4D9B-89D7-3ABF7DBC6519} 5924
      4⤵
      Executes dropped EXE
      PID:5292

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2640

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1920

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1844

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5044

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
PID:880

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1208

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:3556

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:2756

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies registry class
PID:5024

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5460

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Registers COM server for autorun
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:328
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 6457681D33D7C8B76B9F23BA6F8E11F9
  2⤵
  - Loads dropped DLL
  PID:3268
- - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
    "C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe" -E -s -m ensurepip -U --default-pip
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2400
  - - C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe
      C:\Users\Admin\AppData\Local\Programs\Python\Python311\python.exe -W ignore::DeprecationWarning -c " import runpy import sys sys.path = ['C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpc6htbu1r\\setuptools-65.5.0-py3-none-any.whl', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpc6htbu1r\\pip-23.2.1-py3-none-any.whl'] + sys.path sys.argv[1:] = ['install', '--no-cache-dir', '--no-index', '--find-links', 'C:\\Users\\Admin\\AppData\\Local\\Temp\\tmpc6htbu1r', '--upgrade', 'setuptools', 'pip'] runpy.run_module(\"pip\", run_name=\"__main__\", alter_sys=True) "
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5728
    - - C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c "ver"
        5⤵
        
        PID:5596

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:6024
- C:\Users\Admin\AppData\Local\Temp\onefile_6024_133532937958051667\loader.exe
  "C:\Users\Admin\Desktop\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2368

C:\Users\Admin\Desktop\loader.exe
"C:\Users\Admin\Desktop\loader.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Checks whether UAC is enabled
PID:4896
- C:\Users\Admin\AppData\Local\Temp\onefile_4896_133532938018976728\loader.exe
  "C:\Users\Admin\Desktop\loader.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:4120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery