discordrat | d0edb846b44e046fee8fea55dba1160e988ccfc947cf51fbb2803ded90268d19

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	wmiprvse.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	wmiprvse.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 13 IoCs

Web Service

T1102

flow	ioc
70	discord.com
84	discord.com
99	discord.com
100	discord.com
102	discord.com
80	raw.githubusercontent.com
98	discord.com
101	discord.com
8	discord.com
20	discord.com
79	raw.githubusercontent.com
104	discord.com
7	discord.com

Drops file in System32 directory 12 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4KernelMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Winevt\Logs\Microsoft-Windows-Security-Mitigations%4UserMode.evtx	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Work	svchost.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Wake To Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_CBDCCBFE4F7A916411C1E69BDD97BB04	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\FB0D848F74F70BB2EAA93746D24D9749	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml	OfficeClickToRun.exe
File opened for modification	C:\Windows\System32\Tasks\Microsoft\Windows\UpdateOrchestrator\Schedule Maintenance Work	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506	svchost.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 8 set thread context of 5424	8	RobloxPlayer.exe	108

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier	mousocoreworker.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WerFault.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

pid	Process
5176	SCHTASKS.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WerFault.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WerFault.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	mousocoreworker.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	wmiprvse.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\cc176cd7_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\5 = 0b0000000000000000000000000000000000000000000000	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\cc176cd7_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\4 = 0420000000000000180000000000000000000000000000000000803f0000803f	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Internet Explorer\LowRegistry\Audio\PolicyConfig\PropertyStore\cc176cd7_0\{219ED5A0-9CBF-4F3A-B927-37C9E5C5F14F}\3 = 04000000000000000000803f000000000000000000000000	svchost.exe

Modifies data under HKEY_USERS 14 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe = "Sun, 26 May 2024 02:03:56 GMT"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSTagIds0 = "5804129,7202269,17110992,41484365,39965824,7153487,17110988,508368333,17962391,17962392,3462423,3702920,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617"	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,1329 15,1329 100,1329 6"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry	OfficeClickToRun.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe\RulesEndpoint = "https://nexusrules.officeapps.live.com/nexus/rules?Application=officeclicktorun.exe&Version=16.0.12527.20470&ClientId={8B7A11B3-DFB2-4302-BB6C-2DF5F3E835FF}&OSEnvironment=10&MsoAppId=37&AudienceName=Production&AudienceGroup=Production&AppVersion=16.0.12527.20470&"	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\MICROSOFT\OFFICE\16.0\COMMON\CLIENTTELEMETRY\RULESMETADATA\OFFICECLICKTORUN.EXE\ULSMONITOR	OfficeClickToRun.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common	OfficeClickToRun.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesLastModified\officeclicktorun.exe_queried = "1716689036"	OfficeClickToRun.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officeclicktorun.exe	OfficeClickToRun.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000_Classes\Local Settings	firefox.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
8	RobloxPlayer.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
6108	WerFault.exe
6108	WerFault.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5548	svchost.exe
5548	svchost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
8	RobloxPlayer.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe
5424	dllhost.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1252	Process not Found
1172	Process not Found
1292	Process not Found
6056	Process not Found
1908	Process not Found
3080	Process not Found
3920	Process not Found
2504	Process not Found
1208	Process not Found
5404	Process not Found
2540	Process not Found
2996	Process not Found
5052	Process not Found
4684	Process not Found
2524	Process not Found
264	Process not Found
4032	Process not Found
5216	Process not Found
1072	Process not Found
3176	Process not Found
5264	Process not Found
6124	Process not Found
1476	Process not Found
5256	Process not Found
3052	Process not Found
5328	Process not Found
5884	Process not Found
4076	Process not Found
1988	Process not Found
4800	Process not Found
1036	Process not Found
5896	Process not Found
4156	Process not Found
5048	Process not Found
4172	Process not Found
4200	Process not Found
4708	Process not Found
4304	Process not Found
6004	Process not Found
5648	Process not Found
5816	Process not Found
4308	Process not Found
4356	Process not Found
4816	Process not Found
228	Process not Found
5640	Process not Found
5376	Process not Found
5972	Process not Found
5696	Process not Found
5520	Process not Found
5692	Process not Found
5724	Process not Found
5612	Process not Found
5720	Process not Found
6088	Process not Found
5292	Process not Found
3956	Process not Found
1080	Process not Found
5556	Process not Found
648	Process not Found
1288	Process not Found
956	Process not Found
4952	Process not Found
2592	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	RobloxPlayer.exe
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	3596	firefox.exe
Token: SeDebugPrivilege	8	RobloxPlayer.exe
Token: SeDebugPrivilege	5424	dllhost.exe
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeAuditPrivilege	2840	svchost.exe
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3536	Explorer.EXE
Token: SeCreatePagefilePrivilege	3536	Explorer.EXE
Token: SeShutdownPrivilege	3260	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3260	mousocoreworker.exe
Token: SeShutdownPrivilege	3260	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3260	mousocoreworker.exe
Token: SeShutdownPrivilege	3260	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3260	mousocoreworker.exe
Token: SeShutdownPrivilege	3260	mousocoreworker.exe
Token: SeCreatePagefilePrivilege	3260	mousocoreworker.exe
Token: SeAssignPrimaryTokenPrivilege	1896	svchost.exe
Token: SeIncreaseQuotaPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeTakeOwnershipPrivilege	1896	svchost.exe
Token: SeLoadDriverPrivilege	1896	svchost.exe
Token: SeSystemtimePrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeRestorePrivilege	1896	svchost.exe
Token: SeShutdownPrivilege	1896	svchost.exe
Token: SeSystemEnvironmentPrivilege	1896	svchost.exe
Token: SeUndockPrivilege	1896	svchost.exe
Token: SeManageVolumePrivilege	1896	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1896	svchost.exe
Token: SeIncreaseQuotaPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeTakeOwnershipPrivilege	1896	svchost.exe
Token: SeLoadDriverPrivilege	1896	svchost.exe
Token: SeSystemtimePrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeRestorePrivilege	1896	svchost.exe
Token: SeShutdownPrivilege	1896	svchost.exe
Token: SeSystemEnvironmentPrivilege	1896	svchost.exe
Token: SeUndockPrivilege	1896	svchost.exe
Token: SeManageVolumePrivilege	1896	svchost.exe
Token: SeAuditPrivilege	2840	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	1896	svchost.exe
Token: SeIncreaseQuotaPrivilege	1896	svchost.exe
Token: SeSecurityPrivilege	1896	svchost.exe
Token: SeTakeOwnershipPrivilege	1896	svchost.exe
Token: SeLoadDriverPrivilege	1896	svchost.exe
Token: SeSystemtimePrivilege	1896	svchost.exe
Token: SeBackupPrivilege	1896	svchost.exe
Token: SeRestorePrivilege	1896	svchost.exe
Token: SeShutdownPrivilege	1896	svchost.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe
3596	firefox.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3596	firefox.exe
3536	Explorer.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 4052 wrote to memory of 3596	4052	firefox.exe	96
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 3324	3596	firefox.exe	98
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100
PID 3596 wrote to memory of 4728	3596	firefox.exe	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:612
- C:\Windows\system32\dwm.exe
  "dwm.exe"
  2⤵
  PID:1012
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{c465767e-89ff-4265-96fc-24603b3e59ec}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5424
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 612 -s 888
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:664

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM
1⤵
PID:940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s gpsvc
1⤵
PID:404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s lmhosts
1⤵
PID:936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s NcbService
1⤵
PID:1084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s TimeBrokerSvc
1⤵
PID:1100

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s EventLog
1⤵
- Drops file in System32 directory
PID:1160

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Schedule
1⤵
- Drops file in System32 directory
PID:1184
- C:\Windows\system32\taskhostw.exe
  taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
  2⤵
  PID:2672

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s ProfSvc
1⤵
PID:1244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s nsi
1⤵
PID:1320

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc
1⤵
PID:1336

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s Dhcp
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UserManager
1⤵
PID:1440
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2520
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:6120
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5256
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:2368
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5584
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5984
- C:\Windows\system32\sihost.exe
  sihost.exe
  2⤵
  PID:5476

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s EventSystem
1⤵
PID:1500

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s Themes
1⤵
PID:1528

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s NlaSvc
1⤵
PID:1644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s SENS
1⤵
PID:1692

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s AudioEndpointBuilder
1⤵
PID:1744

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s netprofm
1⤵
PID:1772

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
- Modifies Internet Explorer settings
PID:1888

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s Dnscache
1⤵
PID:1964

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1980

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s StateRepository
1⤵
PID:1348

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p -s ShellHWDetection
1⤵
PID:1640

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s Winmgmt
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896

C:\Windows\System32\spoolsv.exe
C:\Windows\System32\spoolsv.exe
1⤵
PID:2128

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -s RmSvc
1⤵
PID:2184

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p -s LanmanWorkstation
1⤵
PID:2340

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted -p -s PolicyAgent
1⤵
PID:2624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s IKEEXT
1⤵
PID:2632

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k NetworkService -p -s CryptSvc
1⤵
- Drops file in System32 directory
PID:2736

C:\Windows\sysmon.exe
C:\Windows\sysmon.exe
1⤵
PID:2824

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s LanmanServer
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s TrkWks
1⤵
PID:2848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s WpnService
1⤵
PID:2856

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s TokenBroker
1⤵
PID:2888

C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wbem\unsecapp.exe -Embedding
1⤵
PID:3084

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s CDPSvc
1⤵
PID:3436

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3536
- C:\Users\Admin\AppData\Local\Temp\RobloxPlayer.exe
  "C:\Users\Admin\AppData\Local\Temp\RobloxPlayer.exe"
  2⤵
  - Suspicious use of NtCreateUserProcessOtherParentProcess
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:8
- - C:\Windows\SYSTEM32\SCHTASKS.exe
    "SCHTASKS.exe" /create /tn "$77RobloxPlayer.exe" /tr "'C:\Users\Admin\AppData\Local\Temp\RobloxPlayer.exe'" /sc onlogon /rl HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5176
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3596
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.0.788320107\1977161413" -parentBuildID 20230214051806 -prefsHandle 1732 -prefMapHandle 1724 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b937e675-f3b0-4a56-85ea-a26d45c616ce} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 1816 1d6c4a0dd58 gpu
      4⤵
      PID:3324
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.1.478559409\447855270" -parentBuildID 20230214051806 -prefsHandle 2400 -prefMapHandle 2396 -prefsLen 22112 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c1e91bae-b680-4817-b0b4-b73610ceede7} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 2428 1d6b7d89f58 socket
      4⤵
      PID:4728
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.2.1300315223\281465491" -childID 1 -isForBrowser -prefsHandle 3064 -prefMapHandle 3048 -prefsLen 22150 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {29a2ffce-5f6c-46c8-90ea-55e92ea979bc} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 3104 1d6c75f0f58 tab
      4⤵
      PID:4332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.3.2133370678\1211981237" -childID 2 -isForBrowser -prefsHandle 3776 -prefMapHandle 3772 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6a4ae0d-63be-48f0-86ec-9ce04fe37be0} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 3796 1d6c9b70d58 tab
      4⤵
      PID:2776
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.4.1244995237\71464186" -childID 3 -isForBrowser -prefsHandle 5064 -prefMapHandle 5032 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a7978ab8-1fd5-486c-8cd7-3d82e2e517fd} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 5072 1d6cb711b58 tab
      4⤵
      PID:2980
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.5.762987501\1377002446" -childID 4 -isForBrowser -prefsHandle 5220 -prefMapHandle 5224 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3ce6a594-6be4-4031-ba30-c238ee8ba6e8} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 5208 1d6cbe0ce58 tab
      4⤵
      PID:1620
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.6.1677371873\1294080851" -childID 5 -isForBrowser -prefsHandle 5496 -prefMapHandle 5492 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5e97b633-92ec-45aa-bd66-65d66c1c5c6e} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 5504 1d6cbe0dd58 tab
      4⤵
      PID:4588
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3596.7.224071960\2027648408" -childID 6 -isForBrowser -prefsHandle 5996 -prefMapHandle 5992 -prefsLen 27697 -prefMapSize 235121 -jsInitHandle 1264 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b709ab7e-2deb-44ca-8767-3ee0d8cb9b13} 3596 "\\.\pipe\gecko-crash-server-pipe.3596" 6004 1d6cd8c6858 tab
      4⤵
      PID:5516

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3648

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3836

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3992

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2408

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4840

C:\Windows\system32\SppExtComObj.exe
C:\Windows\system32\SppExtComObj.exe -Embedding
1⤵
PID:3304

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager
1⤵
PID:2284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
1⤵
PID:1672

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
1⤵
PID:4936

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s SSDPSRV
1⤵
PID:1140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s WinHttpAutoProxySvc
1⤵
- Modifies data under HKEY_USERS
PID:1756

C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe
"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe" /service
1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:1352

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:1028

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4860

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1884

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:3724

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
PID:1044

C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\servicing\TrustedInstaller.exe
1⤵
PID:2704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s PcaSvc
1⤵
PID:1656

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
1⤵
PID:4748

C:\Windows\System32\mousocoreworker.exe
C:\Windows\System32\mousocoreworker.exe -Embedding
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3260

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Scheduled Task/Job

Privilege Escalation

Scheduled Task/Job

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

System Information Discovery