hxxps://drive[.]google[.]com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "0"	WinXP.Horror.Destructive.exe

UAC bypass 3 TTPs 2 IoCs

evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinXP.Horror.Destructive.exe

Disables RegEdit via registry modification 1 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	WinXP.Horror.Destructive.exe

Disables Task Manager via registry modification
evasion

Sets file to hidden 1 TTPs 5 IoCs

Modifies file attributes to stop it showing in Explorer etc.

Hidden Files and Directories

T1564.001

pid	Process
2140	attrib.exe
4920	attrib.exe
3972	attrib.exe
3412	attrib.exe
2128	attrib.exe

Executes dropped EXE 8 IoCs

pid	Process
3344	xxx.exe
4580	xxx.exe
1072	xxx.exe
2244	xxx.exe
1644	MrsMajor 3.0.exe
1048	eulascr.exe
4840	xxx.exe
2300	WinXP.Horror.Destructive.exe

Loads dropped DLL 1 IoCs

pid	Process
1048	eulascr.exe

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral1/memory/1048-3297-0x0000000000E80000-0x0000000000EAA000-memory.dmp	agile_net

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinXP.Horror.Destructive.exe
Delete value	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WinXP.Horror.Destructive.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

flow	ioc
284	drive.google.com
3	drive.google.com
8	drive.google.com
275	camo.githubusercontent.com
276	camo.githubusercontent.com
280	drive.google.com
281	drive.google.com
2	drive.google.com
5	drive.google.com
277	camo.githubusercontent.com
278	camo.githubusercontent.com
283	drive.google.com

Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

description	ioc	Process
File opened for modification	\??\PhysicalDrive0	WinXP.Horror.Destructive.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies Control Panel 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Control Panel\Mouse	WinXP.Horror.Destructive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Control Panel\Mouse\SwapMouseButtons = "1"	WinXP.Horror.Destructive.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Internet Explorer\TypedURLs	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0\NodeSlot = "4"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	firefox.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\WFlags = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0 = 56003100000000005558bb7a100057696e646f777300400009000400efbec5522d605d58e8ab2e000000a60500000000010000000000000000000000000000004a529100570069006e0064006f0077007300000016000000	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupView = "0"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "1"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 020000000100000000000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	taskmgr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0\0 = 1e00718000000000000000000000e1a40ed25739d211a40b0c50205241530000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1 = 19002f433a5c000000000000000000000000000000000000000000	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\GroupByKey:PID = "0"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2\0 = 0c0001008421de39050000000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\FFlags = "287309825"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\MRUListEx = ffffffff	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 0000000001000000ffffffff	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\ShowCmd = "1"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\2 = 14001f706806ee260aa0d7449371beb064c986830000	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\Vid = "{65F125E5-7BE1-4810-BA9D-D271C8432CE3}"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\MRUListEx = 00000000ffffffff	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 020202	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Downloads"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616257"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0\NodeSlot = "3"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3	taskmgr.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Generic"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\AllFolders\Shell\Microsoft.Windows.ControlPanel\HotKey = "0"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\MRUListEx = 00000000ffffffff	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\1\0\0 = 5a003100000000005d58e7ab100053797374656d33320000420009000400efbec5522d605d58e7ab2e0000008f3600000000010000000000000000000000000000003c848b00530079007300740065006d0033003200000018000000	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\LogicalViewMode = "1"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{5C4F28B5-F869-4E84-8E60-F11DB97C5CC7}\IconSize = "16"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-3594324687-1993884830-4019639329-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\xxx.7z:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\MrsMajor 3.0.7z:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\WinXP Horror Edition.7z:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4724	explorer.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 4 IoCs

pid	Process
4476	7zFM.exe
3204	taskmgr.exe
2300	7zFM.exe
3628	7zFM.exe

Suspicious use of AdjustPrivilegeToken 32 IoCs

description	pid	Process
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeRestorePrivilege	4476	7zFM.exe
Token: 35	4476	7zFM.exe
Token: SeSecurityPrivilege	4476	7zFM.exe
Token: SeDebugPrivilege	4728	firefox.exe
Token: SeShutdownPrivilege	2852	control.exe
Token: SeCreatePagefilePrivilege	2852	control.exe
Token: SeDebugPrivilege	3204	taskmgr.exe
Token: SeSystemProfilePrivilege	3204	taskmgr.exe
Token: SeCreateGlobalPrivilege	3204	taskmgr.exe
Token: 33	3204	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3204	taskmgr.exe
Token: SeDebugPrivilege	4968	firefox.exe
Token: SeDebugPrivilege	4968	firefox.exe
Token: SeDebugPrivilege	4968	firefox.exe
Token: SeRestorePrivilege	2300	7zFM.exe
Token: 35	2300	7zFM.exe
Token: SeSecurityPrivilege	2300	7zFM.exe
Token: SeDebugPrivilege	1048	eulascr.exe
Token: SeDebugPrivilege	552	firefox.exe
Token: SeDebugPrivilege	552	firefox.exe
Token: SeDebugPrivilege	552	firefox.exe
Token: SeRestorePrivilege	3628	7zFM.exe
Token: 35	3628	7zFM.exe
Token: SeSecurityPrivilege	3628	7zFM.exe
Token: 33	2456	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2456	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4476	7zFM.exe
4476	7zFM.exe
4724	explorer.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe
3204	taskmgr.exe

Suspicious use of SetWindowsHookEx 28 IoCs

pid	Process
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
4728	firefox.exe
3344	xxx.exe
4580	xxx.exe
1804	MiniSearchHost.exe
4724	explorer.exe
3204	taskmgr.exe
1072	xxx.exe
2244	xxx.exe
4968	firefox.exe
4968	firefox.exe
4968	firefox.exe
4968	firefox.exe
1644	MrsMajor 3.0.exe
4840	xxx.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
552	firefox.exe
2300	WinXP.Horror.Destructive.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 1404 wrote to memory of 4728	1404	firefox.exe	80
PID 4728 wrote to memory of 3444	4728	firefox.exe	81
PID 4728 wrote to memory of 3444	4728	firefox.exe	81
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 1664	4728	firefox.exe	82
PID 4728 wrote to memory of 3864	4728	firefox.exe	84
PID 4728 wrote to memory of 3864	4728	firefox.exe	84
PID 4728 wrote to memory of 3864	4728	firefox.exe	84

System policy modification 1 TTPs 7 IoCs

Modify Registry

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	wscript.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	WinXP.Horror.Destructive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	WinXP.Horror.Destructive.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	WinXP.Horror.Destructive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDesktop = "1"	WinXP.Horror.Destructive.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\HideFastUserSwitching = "1"	WinXP.Horror.Destructive.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	wscript.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 5 IoCs

Hidden Files and Directories

T1564.001

pid	Process
3412	attrib.exe
2128	attrib.exe
2140	attrib.exe
4920	attrib.exe
3972	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://drive.google.com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download"
1⤵
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://drive.google.com/uc?id=12YeQDAR0M7mbsSxDsV_5HA_Xczo5Uqig&export=download
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.0.1269583299\476609789" -parentBuildID 20221007134813 -prefsHandle 1744 -prefMapHandle 1736 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {15c9d35c-64d9-4711-ae12-cb4f74dc6f26} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 1692 20b7fd08358 gpu
    3⤵
    PID:3444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.1.1498943605\779765594" -parentBuildID 20221007134813 -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 21563 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1a10d359-518a-428f-9094-b8decb37d3e2} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 2284 20b7f20d558 socket
    3⤵
    - Checks processor information in registry
    PID:1664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.2.926349176\1365003526" -childID 1 -isForBrowser -prefsHandle 2848 -prefMapHandle 2992 -prefsLen 21666 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9c6a90a7-3baa-4638-b278-ef91deba1ece} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 2968 20b087cbb58 tab
    3⤵
    PID:3864
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.3.2144149486\1399962851" -childID 2 -isForBrowser -prefsHandle 3504 -prefMapHandle 3500 -prefsLen 26064 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f7cbb3e0-c475-458c-8cbb-b0181081994e} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 3516 20b09bd2e58 tab
    3⤵
    PID:1296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.4.1250506535\1861671800" -childID 3 -isForBrowser -prefsHandle 4924 -prefMapHandle 4928 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {55ea1e9a-19da-4514-a516-14eaa5c1aeaf} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 4516 20b0b87c858 tab
    3⤵
    PID:2836
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.5.1423770124\363609838" -childID 4 -isForBrowser -prefsHandle 5072 -prefMapHandle 5076 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53c91b61-b526-4469-a90f-522894b1e57f} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 4848 20b0b879258 tab
    3⤵
    PID:2644
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.6.819886560\1691399970" -childID 5 -isForBrowser -prefsHandle 5272 -prefMapHandle 5276 -prefsLen 26123 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {70f24f7e-11f3-4b97-ad7d-5cf1c19424ff} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 5264 20b0b87ce58 tab
    3⤵
    PID:2708
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.7.257257219\1987883209" -childID 6 -isForBrowser -prefsHandle 3352 -prefMapHandle 3348 -prefsLen 30044 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1ad3f755-c212-449e-94f1-a34262f3ba52} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 3328 20b08823e58 tab
    3⤵
    PID:4300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.8.1447912122\1387917466" -childID 7 -isForBrowser -prefsHandle 4360 -prefMapHandle 4316 -prefsLen 30044 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bca821b9-8e7a-4025-945a-ac1cdf16f6dd} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 3464 20b0b641658 tab
    3⤵
    PID:2128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.9.1033889544\1821313593" -childID 8 -isForBrowser -prefsHandle 5204 -prefMapHandle 5200 -prefsLen 30044 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {663bc9f2-a3ae-451c-8c01-932905cca8ad} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 5192 20b14241258 tab
    3⤵
    PID:1156
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.10.161352693\811525131" -childID 9 -isForBrowser -prefsHandle 5204 -prefMapHandle 5232 -prefsLen 30044 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {135bf3d1-240a-42c7-9e19-118ac094a895} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 6380 20b0eaa1658 tab
    3⤵
    PID:660
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4728.11.2128496394\1804727472" -childID 10 -isForBrowser -prefsHandle 5600 -prefMapHandle 5840 -prefsLen 30044 -prefMapSize 233444 -jsInitHandle 1296 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7de2d006-5893-499f-ae58-f67b8311c966} 4728 "\\.\pipe\gecko-crash-server-pipe.4728" 5492 20b0eaa0d58 tab
    3⤵
    PID:1956

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\xxx.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4476

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3116

C:\Users\Admin\Downloads\xxx.exe
"C:\Users\Admin\Downloads\xxx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3344
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\A66E.tmp\A66F.tmp\A670.vbs //Nologo
  2⤵
  PID:2160
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h .
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3412
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)
    3⤵
    PID:1952

C:\Users\Admin\Downloads\xxx.exe
"C:\Users\Admin\Downloads\xxx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4580
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\4ED3.tmp\4ED4.tmp\4ED5.vbs //Nologo
  2⤵
  PID:3604
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h .
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:2128
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)
    3⤵
    PID:2220

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1804

C:\Windows\system32\control.exe
"C:\Windows\system32\control.exe" /name Microsoft.AdministrativeTools
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:4480

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4724
- C:\Windows\system32\taskmgr.exe
  "C:\Windows\system32\taskmgr.exe" /7
  2⤵
  - Checks SCSI registry key(s)
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3204
- - C:\Users\Admin\Downloads\xxx.exe
    "C:\Users\Admin\Downloads\xxx.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1072
  - - C:\Windows\system32\wscript.exe
      "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\6218.tmp\6219.tmp\621A.vbs //Nologo
      4⤵
      PID:4440
    - - C:\Windows\System32\attrib.exe
        
        "C:\Windows\System32\attrib.exe" +s +h .
        5⤵
        Sets file to hidden
        Views/modifies file attributes
        
        PID:2140
    - - C:\Windows\System32\mshta.exe
        
        "C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)
        5⤵
        
        PID:3008

C:\Users\Admin\Downloads\xxx.exe
"C:\Users\Admin\Downloads\xxx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2244
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\D1F9.tmp\D1FA.tmp\D20A.vbs //Nologo
  2⤵
  PID:1568
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h .
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:4920
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)
    3⤵
    PID:1704

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:5064
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:4968
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.0.528087801\278581606" -parentBuildID 20221007134813 -prefsHandle 1600 -prefMapHandle 1592 -prefsLen 23951 -prefMapSize 234023 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b61bc5fb-d439-43fb-a37c-4836ef39775d} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 1692 1bc2bce8358 gpu
    3⤵
    PID:4460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.1.1176945341\1691754910" -parentBuildID 20221007134813 -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 23951 -prefMapSize 234023 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1441264d-35b6-41b4-94a8-dc0a13a6cc9f} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 2092 1bc1fee1e58 socket
    3⤵
    - Checks processor information in registry
    PID:820
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.2.670230406\1737775464" -childID 1 -isForBrowser -prefsHandle 3492 -prefMapHandle 3328 -prefsLen 24412 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9e41d180-6dd0-478b-8056-519d16e497a9} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 3456 1bc2bd5eb58 tab
    3⤵
    PID:2948
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.3.1260123710\446416185" -childID 2 -isForBrowser -prefsHandle 3632 -prefMapHandle 3628 -prefsLen 29590 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a4f8055e-9092-4a69-81fd-c7bb9adbb7fc} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 2740 1bc1fe62b58 tab
    3⤵
    PID:1012
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.4.1943367519\778274028" -childID 3 -isForBrowser -prefsHandle 4400 -prefMapHandle 4460 -prefsLen 29649 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {be60e075-f065-405c-a8e7-7e7aab59c8e8} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 4508 1bc32bbf858 tab
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.5.424162295\935666686" -childID 4 -isForBrowser -prefsHandle 5044 -prefMapHandle 5040 -prefsLen 29649 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2487d5cb-d974-4d23-8a0a-6e34110ea721} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 5052 1bc32bbfe58 tab
    3⤵
    PID:3176
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.6.833257928\340798728" -childID 5 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 29649 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c763f61-bcff-4dfb-b150-59cb0e9fea67} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 5180 1bc33a34b58 tab
    3⤵
    PID:1440
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.7.959526882\351357194" -childID 6 -isForBrowser -prefsHandle 5380 -prefMapHandle 5384 -prefsLen 29649 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {daa5ca7e-bb9b-4aff-bdd1-f1b7e2b0efcd} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 5372 1bc33a35458 tab
    3⤵
    PID:1444
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.8.184139373\1913429173" -childID 7 -isForBrowser -prefsHandle 5800 -prefMapHandle 5764 -prefsLen 29649 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {81866fae-787c-4251-88a6-75a64b14ef32} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 5804 1bc359db158 tab
    3⤵
    PID:2756
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4968.9.547093342\2091101138" -childID 8 -isForBrowser -prefsHandle 5640 -prefMapHandle 5064 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1052 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7c9b459d-43c4-47ba-9d65-50e84657b3ac} 4968 "\\.\pipe\gecko-crash-server-pipe.4968" 5656 1bc33e5b258 tab
    3⤵
    PID:2532

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\MrsMajor 3.0.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2300

C:\Users\Admin\Downloads\MrsMajor 3.0.exe
"C:\Users\Admin\Downloads\MrsMajor 3.0.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1644
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\D1A1.tmp\D1A2.tmp\D1A3.vbs //Nologo
  2⤵
  - UAC bypass
  - System policy modification
  PID:4456
- - C:\Users\Admin\AppData\Local\Temp\D1A1.tmp\eulascr.exe
    "C:\Users\Admin\AppData\Local\Temp\D1A1.tmp\eulascr.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    PID:1048

C:\Users\Admin\Downloads\xxx.exe
"C:\Users\Admin\Downloads\xxx.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4840
- C:\Windows\system32\wscript.exe
  "C:\Windows\system32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\3116.tmp\3117.tmp\3118.vbs //Nologo
  2⤵
  PID:2880
- - C:\Windows\System32\attrib.exe
    "C:\Windows\System32\attrib.exe" +s +h .
    3⤵
    - Sets file to hidden
    - Views/modifies file attributes
    PID:3972
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" VBScript:MsgBox("The trust of the innocent is the liar's most useful tool.",16)(Close)
    3⤵
    PID:4048

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4200
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:552
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.0.1638532240\678825101" -parentBuildID 20221007134813 -prefsHandle 1672 -prefMapHandle 1652 -prefsLen 23960 -prefMapSize 234023 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e820c92-ae37-4377-a049-f1ffa6af7059} 552 "\\.\pipe\gecko-crash-server-pipe.552" 1752 22c783e8658 gpu
    3⤵
    PID:1520
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.1.400980155\153353176" -parentBuildID 20221007134813 -prefsHandle 2084 -prefMapHandle 2080 -prefsLen 23960 -prefMapSize 234023 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bf150f8a-9cb0-416a-92d1-11fe97ac47cd} 552 "\\.\pipe\gecko-crash-server-pipe.552" 2096 22c6c4e2658 socket
    3⤵
    - Checks processor information in registry
    PID:4312
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.2.1620672829\398774867" -childID 1 -isForBrowser -prefsHandle 2880 -prefMapHandle 2920 -prefsLen 24421 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {219ce755-8b92-481a-add1-49976327c75a} 552 "\\.\pipe\gecko-crash-server-pipe.552" 2924 22c7bbebc58 tab
    3⤵
    PID:3332
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.3.642481119\227250516" -childID 2 -isForBrowser -prefsHandle 3516 -prefMapHandle 3488 -prefsLen 29599 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7145c4c0-1225-48a1-af9d-5e28398d1620} 552 "\\.\pipe\gecko-crash-server-pipe.552" 3376 22c6c467e58 tab
    3⤵
    PID:4964
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.4.1426717553\1485676933" -childID 3 -isForBrowser -prefsHandle 4128 -prefMapHandle 4480 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e31ee708-d54a-4db6-bfe1-fd5469ef5b06} 552 "\\.\pipe\gecko-crash-server-pipe.552" 4484 22c7f94d258 tab
    3⤵
    PID:4324
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.5.762917150\1734612262" -childID 4 -isForBrowser -prefsHandle 4868 -prefMapHandle 5020 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38387cbc-348e-4de3-9abf-37902fe33bfc} 552 "\\.\pipe\gecko-crash-server-pipe.552" 4988 22c7fef2f58 tab
    3⤵
    PID:4328
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.6.1248000911\1586480255" -childID 5 -isForBrowser -prefsHandle 5164 -prefMapHandle 5168 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0d5914f5-0645-48f1-97d1-85ddb7c7ebf0} 552 "\\.\pipe\gecko-crash-server-pipe.552" 5156 22c7ffd0858 tab
    3⤵
    PID:4832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.7.1809361676\1675266121" -childID 6 -isForBrowser -prefsHandle 5356 -prefMapHandle 5360 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c91c2257-e008-414f-8bab-68ccab574aff} 552 "\\.\pipe\gecko-crash-server-pipe.552" 5348 22c7ffd1458 tab
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="552.8.82711310\715208810" -childID 7 -isForBrowser -prefsHandle 5724 -prefMapHandle 5696 -prefsLen 29658 -prefMapSize 234023 -jsInitHandle 1356 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {24557322-c01e-4a21-b341-abd34334e8d8} 552 "\\.\pipe\gecko-crash-server-pipe.552" 5720 22c813e4a58 tab
    3⤵
    PID:2072

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\WinXP Horror Edition.7z"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3628

C:\Users\Admin\Downloads\WinXP.Horror.Destructive.exe
"C:\Users\Admin\Downloads\WinXP.Horror.Destructive.exe"
1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Disables RegEdit via registry modification
- Executes dropped EXE
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Modifies Control Panel
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:2300

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:844

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004D8 0x00000000000004DC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Modify Registry

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery