redline | hxxp://ryosx[.]cc

System Information Discovery

Processes:

Celery V3.exeCelery V3.exeCelery V3.exeOneDriveSetup.exeCelery V3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Celery V3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Celery V3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Celery V3.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	OneDriveSetup.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	Celery V3.exe

Executes dropped EXE 24 IoCs

Processes:

7z2301-x64.exe7zFM.exewinrar-x64-700.exewinrar-x64-700.exewinrar-x64-700.exeOneDriveSetup.exeOneDriveSetup.exeFileSyncConfig.exeOneDrive.exe7zFM.exe7zFM.exeCelery V3.exeSpy.pifRegAsm.exeRegAsm.exeCelery V3.exeSpy.pifRegAsm.exeCelery V3.exeSpy.pifCelery V3.exeSpy.pifRegAsm.exeRegAsm.exe

pid	process
2004	7z2301-x64.exe
4440	7zFM.exe
1524	winrar-x64-700.exe
3752	winrar-x64-700.exe
1916	winrar-x64-700.exe
4388	OneDriveSetup.exe
2356	OneDriveSetup.exe
384	FileSyncConfig.exe
4468	OneDrive.exe
3288	7zFM.exe
3540	7zFM.exe
2320	Celery V3.exe
4916	Spy.pif
3660	RegAsm.exe
3468	RegAsm.exe
1552	Celery V3.exe
4928	Spy.pif
2884	RegAsm.exe
4884	Celery V3.exe
5072	Spy.pif
4716	Celery V3.exe
3016	Spy.pif
924	RegAsm.exe
4144	RegAsm.exe

Loads dropped DLL 42 IoCs

Processes:

7zFM.exeFileSyncConfig.exeOneDrive.exe7zFM.exe7zFM.exe

pid	process
4440	7zFM.exe
384	FileSyncConfig.exe
384	FileSyncConfig.exe
384	FileSyncConfig.exe
384	FileSyncConfig.exe
384	FileSyncConfig.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
3288	7zFM.exe
3540	7zFM.exe

Modifies system executable filetype association 2 TTPs 7 IoCs

persistence

Modify Registry

Change Default File Association

T1546.001

Processes:

OneDrive.exeOneDrive.exeOneDriveSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\lnkfile\shellex\ContextMenuHandlers\ FileSyncEx	OneDrive.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Registers COM server for autorun 1 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exeFileSyncConfig.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{20894375-46AE-46E2-BAFD-CB38975CDCE6}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ThreadingModel = "Apartment"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A926714B-7BFC-4D08-A035-80021395FFA8}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{021E4F06-9DCC-49AD-88CF-ECC2DA314C8A}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\system32\\shell32.dll"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{9AA2F32D-362A-42D9-9328-24A483E2CCC3}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{4410DC33-BC7C-496B-AA84-4AEA3EEE75F7}\InProcServer32\ThreadingModel = "Both"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\INPROCSERVER32	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\LocalServer32	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{389510b7-9e58-40d7-98bf-60b911cb0ea9}\LocalServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{C5FF006E-2AE9-408C-B85B-2DFDD5449D9C}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileSyncShell.dll"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\InProcServer32\ = "%systemroot%\\SysWow64\\shell32.dll"	FileSyncConfig.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\21.220.1024.0005\\FileCoAuth.exe\""	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{6bb93b4e-44d8-40e2-bd97-42dbcf18a40f}\LocalServer32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{82CA8DE3-01AD-4CEA-9D75-BE4C51810A9E}\InprocServer32\ThreadingModel = "Apartment"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\18.151.0729.0013\\FileCoAuth.exe"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\OneDrive.exe\" /cci /client=Personal"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

OneDriveSetup.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Standalone Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\StandaloneUpdater\\OneDriveSetup.exe\""	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Delete Cached Update Binary = "C:\\Windows\\system32\\cmd.exe /q /c del /q \"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\OneDrive\\Update\\OneDriveSetup.exe\""	OneDriveSetup.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 6 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

OneDriveSetup.exeOneDrive.exeOneDriveSetup.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	OneDriveSetup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	OneDriveSetup.exe

Drops file in Program Files directory 64 IoCs

Processes:

7z2301-x64.exe

description	ioc	process
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ky.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sv.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kaa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lt.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sr-spl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ko.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	7z2301-x64.exe
File created	C:\Program Files\7-Zip\7-zip.dll.tmp	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mr.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nb.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip32.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\th.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\License.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7z.dll	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ru.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz-cyrl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ka.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ps.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sw.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ja.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	7z2301-x64.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.dll	7z2301-x64.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exeOneDrive.exefirefox.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	OneDrive.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates processes with tasklist 1 TTPs 11 IoCs

Process Discovery

T1057

Processes:

tasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exetasklist.exe

pid	process
4852	tasklist.exe
4132	tasklist.exe
3016	tasklist.exe
3532	tasklist.exe
1120	tasklist.exe
3024	tasklist.exe
3228	tasklist.exe
3804	tasklist.exe
872	tasklist.exe
3640	tasklist.exe
2460	tasklist.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDriveSetup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION\OneDrive.exe = "11000"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\IESettingSync	OneDrive.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	OneDrive.exe

Modifies registry class 64 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeOneDrive.exe7z2301-x64.exeFileSyncConfig.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\TypeLib\{4B1C80DA-FA45-468F-B42B-46496BDBE0C5}\1.0\HELPDIR	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{ACDB5DB0-C9D5-461C-BAAA-5DCE0B980E40}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{10C9242E-D604-49B5-99E4-BF87945EF86C}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{8D3F8F15-1DE1-4662-BF93-762EABE988B2}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{2387C6BD-9A36-41A2-88ED-FF731E529384}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ProxyStubClsid32	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{C2FE84F5-E036-4A07-950C-9BFD3EAB983A}\ = "IGetSpaceUsedCallback"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Directory\shellex\ContextMenuHandlers\ FileSyncEx\ = "{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{EA23A664-A558-4548-A8FE-A6B94D37C3CF}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{94269C4E-071A-4116-90E6-52E557067E4E}\VersionIndependentProgID\ = "OOBERequestHandler.OOBERequestHandler"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{AEEBAD4E-3E0A-415B-9B94-19C499CD7B6A}	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{2F12C599-7AA5-407A-B898-09E6E4ED2D1E}	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{0299ECA9-80B6-43C8-A79A-FB1C5F19E7D8}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{869BDA08-7ACF-42B8-91AE-4D8D597C0B33}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{50487D09-FFA9-45E1-8DF5-D457F646CD83}\TypeLib	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{D0ED5C72-6197-4AAD-9B16-53FE461DD85C}\TypeLib\Version = "1.0"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{47E6DCAF-41F8-441C-BD0E-A50D5FE6C4D1}\TypeLib	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\.loop\shell\open\command	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\SyncEngineStorageProviderHandlerProxy.SyncEngineStorageProviderHandlerProxy.1	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{F062BA81-ADFE-4A92-886A-23FD851D6406}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Directory\shellex\DragDropHandlers\7-Zip\ = "{23170F69-40C1-278A-1000-000100020000}"	7z2301-x64.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\odopen\shell\open	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{5999E1EE-711E-48D2-9884-851A709F543D}\TypeLib	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{9489FEB2-1925-4D01-B788-6D912C70F7F2}\VersionIndependentProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{0776ae27-5ab9-4e18-9063-1836da63117a}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\ = "OneDrive"	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{B54E7079-90C9-4C62-A6B8-B2834C33A04A}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{AF60000F-661D-472A-9588-F062F6DB7A0E}\ = "ILoginCallback"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{1B71F23B-E61F-45C9-83BA-235D55F50CF9}\TypeLib	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\ = "ErrorOverlayHandler2 Class"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{1BF42E4C-4AF4-4CFD-A1A0-CF2960B8F63E}\InprocServer32	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{9D613F8A-B30E-4938-8490-CB5677701EBF}\TypeLib	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{A3CA1CF4-5F3E-4AC0-91B9-0D3716E1EAC3}\ProgID	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{2e7c0a19-0438-41e9-81e3-3ad3d64f55ba}\ = "BannerNotificationHandler Class"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{a7126d4c-f492-4eb9-8a2a-f673dbdd3334}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{049FED7E-C3EA-4B66-9D92-10E8085D60FB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{679EC955-75AA-4FB2-A7ED-8C0152ECF409}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDriveSetup.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_CLASSES\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\SHELLFOLDER	FileSyncConfig.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\TypeLib\ = "{909A6CCD-6810-46C4-89DF-05BE7EB61E6C}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{944903E8-B03F-43A0-8341-872200D2DA9C}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{AB807329-7324-431B-8B36-DBD581F56E0B}\ = "SyncEngineCOMServer Class"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{390AF5A7-1390-4255-9BC9-935BFCFA5D57}\TypeLib\Version = "1.0"	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\odopen	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{79A2A54C-3916-41FD-9FAB-F26ED0BBA755}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{c1439245-96b4-47fc-b391-679386c5d40f}\TypeLib\Version = "1.0"	OneDrive.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{7AFDFDDB-F914-11E4-8377-6C3BE50D980C}\InprocServer32	OneDrive.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{fac14b75-7862-4ceb-be41-f53945a61c17}\ProxyStubClsid32	OneDriveSetup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\Interface\{1b7aed4f-fcaf-4da4-8795-c03e635d8edc}\TypeLib\ = "{BAE13F6C-0E2A-4DEB-AA46-B8F55319347C}"	OneDrive.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\SyncEngineFileInfoProvider.SyncEngineFileInfoProvider\CLSID\ = "{71DCE5D6-4B57-496B-AC21-CD5B54EB93FD}"	OneDriveSetup.exe
Key created	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000_Classes\WOW6432Node\CLSID\{917E8742-AA3B-7318-FA12-10485FB322A2}\ProgID	OneDriveSetup.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

Processes:

RegAsm.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064	RegAsm.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\F1A578C4CB5DE79A370893983FD4DA8B67B2B064\Blob = 0b000000010000004800000054006900740061006e00690075006d00200052006f006f007400200043006500720074006900660069006300610074006500200041007500740068006f00720069007400790000000200000001000000cc0000001c0000006c00000001000000000000000000000000000000010000007b00340031003700340034004200450034002d0031003100430035002d0034003900340043002d0041003200310033002d004200410030004300450039003400340039003300380045007d00000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e00300000000000030000000100000014000000f1a578c4cb5de79a370893983fd4da8b67b2b06420000000010000000a03000030820306308201eea003020102020867f7beb96a4c2798300d06092a864886f70d01010b0500302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f72697479301e170d3233303331343130333532305a170d3236303631373130333532305a302e312c302a06035504030c23546974616e69756d20526f6f7420436572746966696361746520417574686f7269747930820122300d06092a864886f70d01010105000382010f003082010a028201010086e4577a5861ce819177d005fa51d5515a936c610ccfcbde5332cd151da647ee881a245c9b02833b02af3d76fe20bd3bfaf7a20973e72ebd9440d09d8c3d2713bdf0d09feb9532acd7a42da2a952daa86a2a88ee427d30959d90bfba05276aa02998a6986fc01306629b79b8405d1f1fa6d9a42f827afc7566340dc2de27012b94bb4a27b3cb1c219a3cb2c14203f34451bd626520edd4dbcc414f593f2acbc48479f7143cbe139cfd129c913e5303dc20f94c44358901b69a848d7ea02e308a311560ac00ae009a29109aeed9713dd8919b97ed598058e17f0726c7a020f710abc06291dfaaf181c6be6a76c89cb68eb0b0ec1cd95f326c7e55588bfd76c5190203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b0500038201010070851293d757e982797dc5f7f27da894ef0cdb329f06a6096e0cf604b0e54711560ef40f5282082e210f55a3db41f312548b7611f5f0dacea3c78b13f6fc243c02b106665be69e184088415b273999b877bee353a248cec7eeb5a095c2174bc9526cafe3372c59dbfbe758134ed351e5147273fec68577ae4552a6f99ac80ca8d0ee422af528858c6be81cb0a8031ab0ae83c0eb5564f4e87a5c06295d3903eee2fdf92d62a7f4d4054deaa79bcaebda4e8b1a6efd42aef9d01c7075728cb13aa8557c85a72532b5e2d6c3e55041c9867ca8f562bbd2ab0c3710d83173ec3781d1dcaac5c6e07ee726624dfdc5814cffd336e17932f89beb9cf7fdbee9bebf61	RegAsm.exe

NTFS ADS 3 IoCs

Processes:

firefox.exefirefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Cel3ry by Ryos.cc.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\7z2301-x64.exe:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\winrar-x64-700.exe:Zone.Identifier	firefox.exe

Runs ping.exe 1 TTPs 4 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXEPING.EXEPING.EXE

pid process

764 PING.EXE
3632 PING.EXE
3344 PING.EXE
4644 PING.EXE
Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

OneDrive.exeOneDrive.exe

pid process

3748 OneDrive.exe
4468 OneDrive.exe

pid	process
764	PING.EXE
3632	PING.EXE
3344	PING.EXE
4644	PING.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

OneDrive.exeOneDriveSetup.exeOneDriveSetup.exeOneDrive.exeSpy.piftaskmgr.exe

pid	process
3748	OneDrive.exe
3748	OneDrive.exe
4388	OneDriveSetup.exe
4388	OneDriveSetup.exe
4388	OneDriveSetup.exe
4388	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
2356	OneDriveSetup.exe
4468	OneDrive.exe
4468	OneDrive.exe
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

OpenWith.exetaskmgr.exe

pid process

1772 OpenWith.exe
1840 taskmgr.exe

pid	process
1772	OpenWith.exe
1840	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 60 IoCs

Processes:

firefox.exe7z2301-x64.exe7zFM.exefirefox.exeOneDriveSetup.exeOneDriveSetup.exe7zFM.exe7zFM.exetasklist.exetasklist.exetaskmgr.exeRegAsm.exetasklist.exetasklist.exeRegAsm.exetasklist.exetasklist.exesdiagnhost.exetasklist.exetasklist.exetasklist.exeRegAsm.exeRegAsm.exetasklist.exetasklist.exe

description	pid	process
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	4992	firefox.exe
Token: SeDebugPrivilege	2004	7z2301-x64.exe
Token: SeDebugPrivilege	2004	7z2301-x64.exe
Token: SeDebugPrivilege	2004	7z2301-x64.exe
Token: SeDebugPrivilege	2004	7z2301-x64.exe
Token: SeDebugPrivilege	2004	7z2301-x64.exe
Token: SeRestorePrivilege	4440	7zFM.exe
Token: 35	4440	7zFM.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeIncreaseQuotaPrivilege	4388	OneDriveSetup.exe
Token: SeIncreaseQuotaPrivilege	2356	OneDriveSetup.exe
Token: SeRestorePrivilege	3288	7zFM.exe
Token: 35	3288	7zFM.exe
Token: SeRestorePrivilege	3540	7zFM.exe
Token: 35	3540	7zFM.exe
Token: SeSecurityPrivilege	3540	7zFM.exe
Token: SeDebugPrivilege	4852	tasklist.exe
Token: SeDebugPrivilege	4132	tasklist.exe
Token: SeDebugPrivilege	1840	taskmgr.exe
Token: SeSystemProfilePrivilege	1840	taskmgr.exe
Token: SeCreateGlobalPrivilege	1840	taskmgr.exe
Token: SeDebugPrivilege	3468	RegAsm.exe
Token: SeBackupPrivilege	3468	RegAsm.exe
Token: SeSecurityPrivilege	3468	RegAsm.exe
Token: SeSecurityPrivilege	3468	RegAsm.exe
Token: SeSecurityPrivilege	3468	RegAsm.exe
Token: SeSecurityPrivilege	3468	RegAsm.exe
Token: SeDebugPrivilege	3016	tasklist.exe
Token: SeDebugPrivilege	3024	tasklist.exe
Token: SeDebugPrivilege	2884	RegAsm.exe
Token: SeBackupPrivilege	2884	RegAsm.exe
Token: SeSecurityPrivilege	2884	RegAsm.exe
Token: SeSecurityPrivilege	2884	RegAsm.exe
Token: SeSecurityPrivilege	2884	RegAsm.exe
Token: SeSecurityPrivilege	2884	RegAsm.exe
Token: 33	1840	taskmgr.exe
Token: SeIncBasePriorityPrivilege	1840	taskmgr.exe
Token: SeDebugPrivilege	3228	tasklist.exe
Token: SeDebugPrivilege	3532	tasklist.exe
Token: SeDebugPrivilege	3176	sdiagnhost.exe
Token: SeDebugPrivilege	1120	tasklist.exe
Token: SeDebugPrivilege	3804	tasklist.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	924	RegAsm.exe
Token: SeBackupPrivilege	924	RegAsm.exe
Token: SeSecurityPrivilege	924	RegAsm.exe
Token: SeSecurityPrivilege	924	RegAsm.exe
Token: SeSecurityPrivilege	924	RegAsm.exe
Token: SeSecurityPrivilege	924	RegAsm.exe
Token: SeDebugPrivilege	4144	RegAsm.exe
Token: SeBackupPrivilege	4144	RegAsm.exe
Token: SeSecurityPrivilege	4144	RegAsm.exe
Token: SeSecurityPrivilege	4144	RegAsm.exe
Token: SeSecurityPrivilege	4144	RegAsm.exe
Token: SeSecurityPrivilege	4144	RegAsm.exe
Token: SeDebugPrivilege	3640	tasklist.exe
Token: SeDebugPrivilege	2460	tasklist.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

firefox.exe7zFM.exefirefox.exeOneDrive.exeOneDrive.exe7zFM.exe7zFM.exeSpy.piftaskmgr.exe

pid	process
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4440	7zFM.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
3748	OneDrive.exe
3748	OneDrive.exe
3748	OneDrive.exe
3748	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
3288	7zFM.exe
3288	7zFM.exe
3288	7zFM.exe
3540	7zFM.exe
3540	7zFM.exe
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

firefox.exefirefox.exeOneDrive.exeOneDrive.exeSpy.piftaskmgr.exe

pid	process
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
3748	OneDrive.exe
3748	OneDrive.exe
3748	OneDrive.exe
3748	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4468	OneDrive.exe
4916	Spy.pif
4916	Spy.pif
4916	Spy.pif
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe
1840	taskmgr.exe

Suspicious use of SetWindowsHookEx 64 IoCs

Processes:

firefox.exeOpenWith.exe7z2301-x64.exeOpenWith.exefirefox.exe

pid	process
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
2900	OpenWith.exe
4992	firefox.exe
4992	firefox.exe
4992	firefox.exe
2004	7z2301-x64.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1772	OpenWith.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4992	3968	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 2732	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe
PID 4992 wrote to memory of 4484	4992	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "http://ryosx.cc"
2⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url http://ryosx.cc
3⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4992

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.0.723612280\409011900" -parentBuildID 20230214051806 -prefsHandle 1812 -prefMapHandle 1804 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e3f85d4d-9c42-4773-b413-abbc6d244b37} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 1904 285abe0e358 gpu
4⤵
PID:2732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.1.1904476450\867039705" -parentBuildID 20230214051806 -prefsHandle 2460 -prefMapHandle 2456 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1e0d4295-f264-48af-a1ca-384be6842e8b} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 2488 28597a8a258 socket
4⤵
- Checks processor information in registry
PID:4484

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.2.1801247521\1828804731" -childID 1 -isForBrowser -prefsHandle 2892 -prefMapHandle 2916 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa1318af-d613-4551-94d7-c45a6abe9623} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 2980 285acf3fc58 tab
4⤵
PID:4652

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.3.1856064885\2099411814" -childID 2 -isForBrowser -prefsHandle 3720 -prefMapHandle 3724 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e31725d0-0a34-4341-a9dc-d35b749dbc44} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 3756 285ad1a8458 tab
4⤵
PID:3288

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.4.795583717\1978320654" -childID 3 -isForBrowser -prefsHandle 4984 -prefMapHandle 4972 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a0a25305-3c4b-427d-85d1-dbe264c774e2} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 4992 285b2351e58 tab
4⤵
PID:1448

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.5.1187523746\442857346" -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5004 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ea8b81c-e856-4e0b-a07b-783efd7ffacc} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 5232 285b2577058 tab
4⤵
PID:2888

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.6.1713198168\612992579" -childID 5 -isForBrowser -prefsHandle 5452 -prefMapHandle 5448 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {49ceaf4d-a731-4ee4-b575-90caebc43695} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 5460 285b2577958 tab
4⤵
PID:4644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.7.1351996979\306636999" -childID 6 -isForBrowser -prefsHandle 5660 -prefMapHandle 5656 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {72b1d0fa-2c38-4c56-8091-76c8d52e943a} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 5676 285b28bd158 tab
4⤵
PID:4628

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.8.1701962075\362985675" -childID 7 -isForBrowser -prefsHandle 5592 -prefMapHandle 5420 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b25f084e-d3b4-429e-b227-0a63fb1a7562} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 5872 285b3937058 tab
4⤵
PID:1772

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.9.2014527615\1830975111" -childID 8 -isForBrowser -prefsHandle 7104 -prefMapHandle 7100 -prefsLen 31262 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {cc5d655d-446d-4558-906e-8470df86a19c} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 7112 285b8614358 tab
4⤵
PID:2392

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.10.330400741\2028676382" -childID 9 -isForBrowser -prefsHandle 3548 -prefMapHandle 4024 -prefsLen 31341 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8b94a4bf-c5bd-412f-b231-20c37854fa3c} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 3544 285b8612e58 tab
4⤵
PID:3512

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.11.1217015859\1558538329" -childID 10 -isForBrowser -prefsHandle 10300 -prefMapHandle 10292 -prefsLen 31403 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c014638c-6ff3-4264-a1d3-9ec520007ed6} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 10812 285af15ca58 tab
4⤵
PID:5000

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4992.12.1081820671\464025464" -childID 11 -isForBrowser -prefsHandle 6556 -prefMapHandle 10704 -prefsLen 31403 -prefMapSize 235121 -jsInitHandle 896 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e39e35b8-cc7a-4212-9c01-952c28cfeaaf} 4992 "\\.\pipe\gecko-crash-server-pipe.4992" 10712 285acfb9b58 tab
4⤵
PID:2536

C:\Users\Admin\Downloads\7z2301-x64.exe
"C:\Users\Admin\Downloads\7z2301-x64.exe"
4⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2004

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" C:\Users\Admin\Desktop\Celery.rar
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4440

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
PID:1692

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
3⤵
- Checks processor information in registry
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.0.986578886\232421581" -parentBuildID 20230214051806 -prefsHandle 1772 -prefMapHandle 1764 -prefsLen 25224 -prefMapSize 235664 -appDir "C:\Program Files\Mozilla Firefox\browser" - {92c71933-d476-4fbb-9b89-79183d42fca0} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 1852 260f762bf58 gpu
4⤵
PID:4864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.1.992729511\452205759" -parentBuildID 20230214051806 -prefsHandle 2300 -prefMapHandle 2288 -prefsLen 25224 -prefMapSize 235664 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6aa408dd-93f0-48d6-994a-3023b6a2282a} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 2324 260e3689658 socket
4⤵
- Checks processor information in registry
PID:736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.2.279517863\974396542" -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 2904 -prefsLen 25620 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c35bd82d-2ef1-4f66-a9ea-4ea1843ea4ea} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3168 260fb473258 tab
4⤵
PID:3136

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.3.1585607526\747789269" -childID 2 -isForBrowser -prefsHandle 3672 -prefMapHandle 3668 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a3218511-04e4-4e34-ae15-dde9534c67a3} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3576 260fc888658 tab
4⤵
PID:4228

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.4.779767899\908338139" -childID 3 -isForBrowser -prefsHandle 5032 -prefMapHandle 5040 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0dca264b-6c23-4af3-ad8b-6056b7dfa2c6} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5060 260ff439858 tab
4⤵
PID:1540

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.5.1108830300\939173874" -childID 4 -isForBrowser -prefsHandle 5284 -prefMapHandle 5280 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0aaf0776-bfd3-4c33-98ab-572288835878} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5292 260ff439e58 tab
4⤵
PID:3476

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.6.1218067711\2019046523" -childID 5 -isForBrowser -prefsHandle 5400 -prefMapHandle 5408 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {46dc57ee-41ca-4232-825b-eb76a4b10281} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5484 260ff43a158 tab
4⤵
PID:5084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.7.127296029\303967780" -childID 6 -isForBrowser -prefsHandle 5848 -prefMapHandle 5844 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7076ff70-96c5-4810-bef5-770c0c3139fc} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5856 260f88fba58 tab
4⤵
PID:4064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.8.618627372\332335619" -childID 7 -isForBrowser -prefsHandle 3644 -prefMapHandle 3936 -prefsLen 31086 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5b9d4b98-39dd-4e1e-9e4c-98e4345a4afe} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3812 260e3689058 tab
4⤵
PID:2752

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.9.1412078591\2065282137" -childID 8 -isForBrowser -prefsHandle 2600 -prefMapHandle 2604 -prefsLen 31095 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f01c5511-bea4-4462-9750-958afee85bc4} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 2976 260fd5b2f58 tab
4⤵
PID:1232

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.10.390281213\595736447" -childID 9 -isForBrowser -prefsHandle 5508 -prefMapHandle 5504 -prefsLen 31095 -prefMapSize 235664 -jsInitHandle 1432 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fcbad2d4-9481-4d6c-aa2e-892c840019a1} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5496 260fdd3bb58 tab
4⤵
PID:2040

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
4⤵
- Executes dropped EXE
PID:1524

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
2⤵
- Executes dropped EXE
PID:3752

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe"
2⤵
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3748

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe" /update /restart
3⤵
- Executes dropped EXE
- Checks system information in the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4388

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\Update\OneDriveSetup.exe /update /restart /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions /enableODSUReportingMode
4⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system executable filetype association
- Registers COM server for autorun
- Adds Run key to start application
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe
"C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.220.1024.0005\FileSyncConfig.exe"
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Registers COM server for autorun
- Modifies registry class
PID:384

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
/updateInstalled /background
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies system executable filetype association
- Registers COM server for autorun
- Checks system information in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4468

C:\Users\Admin\Downloads\winrar-x64-700.exe
"C:\Users\Admin\Downloads\winrar-x64-700.exe"
2⤵
- Executes dropped EXE
PID:1916

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" C:\Users\Admin\Desktop\Celery.rar
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3288

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Cel3ry by Ryos.cc.zip\README.txt
2⤵
PID:4408

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_Cel3ry by Ryos.cc.zip\README.txt
2⤵
PID:1680

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" C:\Users\Admin\Desktop\Celery.rar
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3540

C:\Users\Admin\Desktop\Celery\Celery V3.exe
"C:\Users\Admin\Desktop\Celery\Celery V3.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2320

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Earned Earned.cmd && Earned.cmd
3⤵
PID:3208

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4852

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:536

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4132

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:3532

C:\Windows\SysWOW64\cmd.exe
cmd /c md 1171
4⤵
PID:3192

C:\Windows\SysWOW64\findstr.exe
findstr /V "CalculationsExpediaJumpExchanges" Application
4⤵
PID:892

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Trials + Explains + External + Fighting + Get + Rights 1171\z
4⤵
PID:2684

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\Spy.pif
1171\Spy.pif 1171\z
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4916

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:764

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1840

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\RegAsm.exe
2⤵
- Executes dropped EXE
PID:3660

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1171\RegAsm.exe
2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
PID:3468

C:\Users\Admin\Desktop\Celery\Celery V3.exe
"C:\Users\Admin\Desktop\Celery\Celery V3.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1552

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Earned Earned.cmd && Earned.cmd
3⤵
PID:2448

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3016

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:3440

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3024

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd /c md 1131
4⤵
PID:4008

C:\Windows\SysWOW64\findstr.exe
findstr /V "CalculationsExpediaJumpExchanges" Application
4⤵
PID:1936

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Trials + Explains + External + Fighting + Get + Rights 1131\z
4⤵
PID:2716

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1131\Spy.pif
1131\Spy.pif 1131\z
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:4928

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:3632

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1131\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1131\RegAsm.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2884

C:\Windows\System32\t4pfwd.exe
"C:\Windows\System32\t4pfwd.exe"
2⤵
PID:4496

C:\Windows\System32\t4pfwd.exe
"C:\Windows\System32\t4pfwd.exe"
2⤵
PID:4716

C:\Windows\System32\t4pfwd.exe
"C:\Windows\System32\t4pfwd.exe"
2⤵
PID:2948

C:\Users\Admin\Desktop\Celery\Celery V3.exe
"C:\Users\Admin\Desktop\Celery\Celery V3.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4884

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Earned Earned.cmd && Earned.cmd
3⤵
PID:2932

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3228

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:1864

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3532

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:2528

C:\Windows\SysWOW64\cmd.exe
cmd /c md 1121
4⤵
PID:3512

C:\Windows\SysWOW64\findstr.exe
findstr /V "CalculationsExpediaJumpExchanges" Application
4⤵
PID:4488

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Trials + Explains + External + Fighting + Get + Rights 1121\z
4⤵
PID:3440

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1121\Spy.pif
1121\Spy.pif 1121\z
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:5072

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:3344

C:\Windows\system32\pcwrun.exe
C:\Windows\system32\pcwrun.exe "C:\Users\Admin\Desktop\Celery\Celery V3.exe" ContextMenu
2⤵
PID:3096

C:\Windows\System32\msdt.exe
C:\Windows\System32\msdt.exe -path C:\Windows\diagnostics\index\PCWDiagnostic.xml -af C:\Users\Admin\AppData\Local\Temp\PCWFF42.xml /skip TRUE
3⤵
PID:2756

C:\Users\Admin\Desktop\Celery\Celery V3.exe
"C:\Users\Admin\Desktop\Celery\Celery V3.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4716

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c move Earned Earned.cmd && Earned.cmd
3⤵
PID:2372

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1120

C:\Windows\SysWOW64\findstr.exe
findstr /I "wrsa.exe opssvc.exe"
4⤵
PID:1756

C:\Windows\SysWOW64\tasklist.exe
tasklist
4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3804

C:\Windows\SysWOW64\findstr.exe
findstr /I "avastui.exe avgui.exe nswscsvc.exe sophoshealth.exe"
4⤵
PID:4980

C:\Windows\SysWOW64\cmd.exe
cmd /c md 1141
4⤵
PID:4432

C:\Windows\SysWOW64\findstr.exe
findstr /V "CalculationsExpediaJumpExchanges" Application
4⤵
PID:2684

C:\Windows\SysWOW64\cmd.exe
cmd /c copy /b Trials + Explains + External + Fighting + Get + Rights 1141\z
4⤵
PID:1168

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1141\Spy.pif
1141\Spy.pif 1141\z
4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
PID:3016

C:\Windows\SysWOW64\PING.EXE
ping -n 5 127.0.0.1
4⤵
- Runs ping.exe
PID:4644

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
2⤵
PID:1324

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:872

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3640

C:\Windows\system32\tasklist.exe
tasklist
3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2460

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1121\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1121\RegAsm.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1141\RegAsm.exe
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\1141\RegAsm.exe
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4144

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3868

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1772

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\67eaa8c5e37841b3938c1459755f018c /t 1304 /p 1524
1⤵
PID:4324

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\462d8fba086d44f8b3539cee2b6fe275 /t 4052 /p 3752
1⤵
PID:468

C:\Windows\system32\werfault.exe
werfault.exe /h /shared Global\f3e83405dba2439c9f6074f53cf280b9 /t 5060 /p 1916
1⤵
PID:4920

C:\Windows\System32\sdiagnhost.exe
C:\Windows\System32\sdiagnhost.exe -Embedding
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3176

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kcbwftw4\kcbwftw4.cmdline"
2⤵
PID:4524

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2AD.tmp" "c:\Users\Admin\AppData\Local\Temp\kcbwftw4\CSCF7974157A1DA439DA05142D62BC9636F.TMP"
3⤵
PID:2704

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2vk5y0dy\2vk5y0dy.cmdline"
2⤵
PID:540

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES33A.tmp" "c:\Users\Admin\AppData\Local\Temp\2vk5y0dy\CSCC99D730BAA0847409E5491D16AE6315F.TMP"
3⤵
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Event Triggered Execution

T1546

Change Default File Association

T1546.001

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery