sality | ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61

Windows Service

T1543.003

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Sality
Sality is backdoor written in C++, first discovered in 2003.
backdoor sality

UAC bypass 3 TTPs 1 IoCs

Bypass User Account Control

T1548.002

Disable or Modify Tools

Modify Registry

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Windows security bypass 2 TTPs 6 IoCs

Disable or Modify Tools

Modify Registry

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/216-1-0x00000000022B0000-0x000000000336A000-memory.dmp	upx
behavioral1/memory/216-6-0x00000000022B0000-0x000000000336A000-memory.dmp	upx

Windows security modification 2 TTPs 7 IoCs

Disable or Modify Tools

Modify Registry

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

System Information Discovery

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Drops file in Windows directory 4 IoCs

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exetaskmgr.exe

description	ioc	process
File created	C:\Windows\e5766a9	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
File opened for modification	C:\Windows\SYSTEM.INI	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

Processes:

firefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Modifies registry class 1 IoCs

Processes:

firefox.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings firefox.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2916 vlc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe

pid	process
2916	vlc.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

Processes:

taskmgr.exe

pid	process
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2916 vlc.exe

pid	process
2916	vlc.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

Processes:

taskmgr.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	2428	taskmgr.exe
Token: SeSystemProfilePrivilege	2428	taskmgr.exe
Token: SeCreateGlobalPrivilege	2428	taskmgr.exe
Token: 33	2428	taskmgr.exe
Token: SeIncBasePriorityPrivilege	2428	taskmgr.exe
Token: SeDebugPrivilege	4252	firefox.exe
Token: SeDebugPrivilege	4252	firefox.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exevlc.exefirefox.exe

pid	process
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
4252	firefox.exe
4252	firefox.exe
4252	firefox.exe
4252	firefox.exe

Suspicious use of SendNotifyMessage 62 IoCs

Processes:

taskmgr.exevlc.exefirefox.exe

pid	process
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2428	taskmgr.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
2916	vlc.exe
4252	firefox.exe
4252	firefox.exe
4252	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

vlc.exefirefox.exe

pid process

2916 vlc.exe
4252 firefox.exe

pid	process
2916	vlc.exe
4252	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 3968 wrote to memory of 4252	3968	firefox.exe	firefox.exe
PID 4252 wrote to memory of 2380	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 2380	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1124	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1536	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1536	4252	firefox.exe	firefox.exe
PID 4252 wrote to memory of 1536	4252	firefox.exe	firefox.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

Processes:

ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe
"C:\Users\Admin\AppData\Local\Temp\ca30d8ed477161e87f81bc80c3f66be28358d3d44f0d62716f55fcde4481ab61.exe"
1⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System policy modification
PID:216

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2428

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2520

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\AssertClose.MTS"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.0.142795181\236808354" -parentBuildID 20221007134813 -prefsHandle 1700 -prefMapHandle 1676 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {084aef53-23c2-4508-a02c-953286d6f46c} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 1780 256b67daa58 gpu
3⤵
PID:2380

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.1.27260626\1524235949" -parentBuildID 20221007134813 -prefsHandle 2124 -prefMapHandle 2120 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22c08ff8-5e49-4804-8a84-f03f2d0cf40d} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 2136 256ab772e58 socket
3⤵
PID:1124

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.2.272427460\653179198" -childID 1 -isForBrowser -prefsHandle 2868 -prefMapHandle 2864 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eec6f78d-903a-42cc-8aa7-faba00e545a4} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 2880 256ba896e58 tab
3⤵
PID:1536

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.3.149412116\552572828" -childID 2 -isForBrowser -prefsHandle 3488 -prefMapHandle 3484 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a82e7509-d1fa-4820-ad00-a9ea7bea0ffd} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 3252 256ab762b58 tab
3⤵
PID:4116

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.4.1373344087\1713307607" -childID 3 -isForBrowser -prefsHandle 4220 -prefMapHandle 4216 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b0ada6a-d4e0-42f1-837f-eae652cc32c7} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 4232 256bc666e58 tab
3⤵
PID:4272

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.5.400014856\2032777768" -childID 4 -isForBrowser -prefsHandle 4728 -prefMapHandle 4764 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cd0947f-b1aa-44ef-84ed-1a8356d507c8} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 4788 256baeab858 tab
3⤵
PID:4548

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.6.700530769\1716306085" -childID 5 -isForBrowser -prefsHandle 4940 -prefMapHandle 4936 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4f54c55a-fce9-449d-90ce-75664b6d75fb} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 4632 256bcba7558 tab
3⤵
PID:3120

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.7.298259192\335510761" -childID 6 -isForBrowser -prefsHandle 5064 -prefMapHandle 5068 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e4eae39c-a96a-4897-a60c-a28ab4dd6cbf} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 5052 256bcba5158 tab
3⤵
PID:368

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.8.1050250353\146739873" -childID 7 -isForBrowser -prefsHandle 5500 -prefMapHandle 5528 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7f60bda5-046a-454d-8a2c-d3838bec46a0} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 5576 256be418858 tab
3⤵
PID:2984

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.9.1376643214\1571737413" -childID 8 -isForBrowser -prefsHandle 5748 -prefMapHandle 5752 -prefsLen 26328 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {149ed8b1-2f01-4559-882a-798424d5ae72} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 5740 256be418e58 tab
3⤵
PID:2456

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.10.1036856017\1492206294" -parentBuildID 20221007134813 -prefsHandle 5928 -prefMapHandle 5916 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbbcf632-2548-452a-8ebc-7b273ba0f7d6} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 5924 256be74ae58 rdd
3⤵
PID:5376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.11.361901028\1469491144" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 6152 -prefMapHandle 6148 -prefsLen 26328 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {141b7484-f5ce-4c29-8860-aabf0a592474} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 6164 256be77e858 utility
3⤵
PID:5400

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.12.858794259\304531417" -childID 9 -isForBrowser -prefsHandle 6552 -prefMapHandle 6412 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3e71cd9c-2cd4-427f-8f10-78be1172a783} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 6560 256bec39958 tab
3⤵
PID:5736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.13.1513297911\799447462" -childID 10 -isForBrowser -prefsHandle 3468 -prefMapHandle 3464 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {af86271d-946e-4ac1-ab39-402c01d67081} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 2700 256be00ef58 tab
3⤵
PID:5340

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4252.14.985385210\159778388" -childID 11 -isForBrowser -prefsHandle 5160 -prefMapHandle 5148 -prefsLen 26503 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {13d866ec-e614-422b-a8d9-4d441df84c75} 4252 "\\.\pipe\gecko-crash-server-pipe.4252" 5184 256be0a8858 tab
3⤵
PID:5316

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Defense Evasion

Modify Registry

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

Credential Access

Discovery

System Information Discovery